Overview

overview

10

Static

static

1

ProtonVPN_...64.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    886s
  • max time network
    912s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 00:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProtonVPN_v5.1.5_x64.exe
  • Size 122.8MB
  • Sample260729-a71thadn7x
  • SHA256 1e6600e45c0684d0faa7f040208603b72a0f7b1468b682c1007a31972cba1d9c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationpyinstallerransomwarespywarestealer

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Downloads MZ/PE file 2 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:1096
      • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.5_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.5_x64.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5672
        • C:\Users\Admin\AppData\Local\Temp\is-QMPL1S0C67.tmp\ProtonVPN_v5.1.5_x64.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-QMPL1S0C67.tmp\ProtonVPN_v5.1.5_x64.tmp" /SL5="$60192,127461257,1139200,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.5_x64.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Users\Admin\AppData\Local\Temp\is-MHCVCGXZ53.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-MHCVCGXZ53.tmp\VC_redist.x64.exe" /install /quiet /norestart
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4608
            • C:\Windows\Temp\{7E06B2AC-CBF2-4A17-A84C-D530A157C7EA}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{7E06B2AC-CBF2-4A17-A84C-D530A157C7EA}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-MHCVCGXZ53.tmp\VC_redist.x64.exe" -burn.filehandle.attached=700 -burn.filehandle.self=708 /install /quiet /norestart
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5880
              • C:\Windows\Temp\{FEFBB30C-BDB0-42F6-9037-763347AFFF3C}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{FEFBB30C-BDB0-42F6-9037-763347AFFF3C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{72A3F294-2F65-43FD-A509-B5617435B13D} {32440AB0-7701-42B7-9F62-DC38D62716BD} 5880
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4696
          • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
            "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4252
            • C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.Client.exe
              "v5.1.5\ProtonVPN.Client.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
              5⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies Control Panel
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2584
      • C:\Program Files\Proton\VPN\v5.1.5\ProtonInstaller.exe
        C:\Program Files\Proton\VPN\v5.1.5\ProtonInstaller.exe /Mail /Drive /Pass /CreateDesktopShortcut
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3148
        • C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.3.exe
          "C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.3.exe" Source=vpn /quiet NoAppDataCleanup=1 NoAutoLaunch=1
          3⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2560
          • C:\Windows\TEMP\{139FF784-0977-40DC-BEC1-7D71600EB621}\.ba\wixprqba.exe
            "C:\Windows\TEMP\{139FF784-0977-40DC-BEC1-7D71600EB621}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{B7431819-1D7B-447D-B5EC-058C1CE1EF58} {E815103A-74EF-4E8C-BD17-C36598AB2854}
            4⤵
            • Executes dropped EXE
            PID:2280
          • C:\Windows\TEMP\{139FF784-0977-40DC-BEC1-7D71600EB621}\.ba\wixiuiba.exe
            "C:\Windows\TEMP\{139FF784-0977-40DC-BEC1-7D71600EB621}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{7CF8B5FD-A4F1-40D1-8DE0-AB56B5AB8D9B} {EA2CBABE-4226-48E0-AC50-C3EF7D0C1677}
            4⤵
            • Executes dropped EXE
            PID:4200
        • C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe" --source=vpn --silent=1 --auto-launch=0
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4108
          • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
            "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --source=vpn --silent=1 --auto-launch=0
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2636
            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Squirrel.exe
              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
              5⤵
              • Executes dropped EXE
              PID:5512
            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --squirrel-install 1.13.3 --source="vpn" --desktop-shortcut=1
              5⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:5724
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Proton Mail" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Proton Mail\Crashpad" --url=https://mail-api.proton.me/core/v4/reports/sentry/api/54/minidump/?sentry_key=8c45c7615ac54aed9a6747430e0a5d8e "--annotation=_productName=Proton Mail" --annotation=_version=1.13.3 --annotation=plat=Win64 --annotation=prod=Electron "--annotation=sentry___initialScope={\"release\":\"[email protected]+packaged\",\"environment\":\"proton.me\"}" --annotation=ver=40.10.1 --initial-client-data=0x4c4,0x4c8,0x4cc,0x4c0,0x4d0,0x7ff739125a0c,0x7ff739125a18,0x7ff739125a28
                6⤵
                • Executes dropped EXE
                PID:3056
              • C:\Users\Admin\AppData\Local\proton_mail\Update.exe
                C:\Users\Admin\AppData\Local\proton_mail\Update.exe "--createShortcut=Proton Mail.exe" --shortcut-locations=Desktop,StartMenu
                6⤵
                • Executes dropped EXE
                PID:3400
              • C:\Windows\System32\reg.exe
                C:\Windows\System32\reg.exe import C:\Users\Admin\AppData\Local\Temp\protonmail-mailto-register.reg
                6⤵
                • Modifies registry class
                PID:2364
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1852,i,1077758285772618841,12840920791247834787,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1848 /prefetch:2
                6⤵
                • Executes dropped EXE
                PID:5680
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1852,i,1077758285772618841,12840920791247834787,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2148 /prefetch:11
                6⤵
                • Executes dropped EXE
                PID:464
    • C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.exe
      "C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.exe"
      1⤵
      • Executes dropped EXE
      PID:4256
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4764
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
        PID:2300
      • C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.exe
        "C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.exe"
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3896
        • C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.NrptWatchdog.exe
          "C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.NrptWatchdog.exe" --pid 3896
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3272
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4592
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding 5740CF780AEA9DA538DF0C6F1674E022
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:6068
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI8147.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240812484 2 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
            3⤵
            • Drops file in Windows directory
            PID:4924
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI8280.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240812718 6 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
            3⤵
            • Drops file in Windows directory
            PID:5544
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI836C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240812937 11 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.DoPerMachineUpgradeSupportActions
            3⤵
            • Drops file in Windows directory
            PID:4248
        • C:\Windows\System32\MsiExec.exe
          C:\Windows\System32\MsiExec.exe -Embedding 4CE04552F935C011BA2B2E940E7C1280
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4636
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI9C97.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240819437 36 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
            3⤵
            • Drops file in Windows directory
            PID:5028
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSI9DB2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240819656 40 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
            3⤵
            • Drops file in Windows directory
            PID:5592
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSIA046.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240820296 62 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.RemoveStartupEntry
            3⤵
            • Drops file in Windows directory
            PID:2364
      • C:\Users\Admin\AppData\Local\Package Cache\{939C5A39-9609-40ED-AAD1-1879CDAC2E33}\Proton Drive Setup 3.0.3 (9a6f9411) (x64).exe
        "C:\Users\Admin\AppData\Local\Package Cache\{939C5A39-9609-40ED-AAD1-1879CDAC2E33}\Proton Drive Setup 3.0.3 (9a6f9411) (x64).exe" /burn.runonce
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5764
        • C:\Users\Admin\AppData\Local\Package Cache\{939C5A39-9609-40ED-AAD1-1879CDAC2E33}\Proton Drive Setup 3.0.3 (9a6f9411) (x64).exe
          "C:\Users\Admin\AppData\Local\Package Cache\{939C5A39-9609-40ED-AAD1-1879CDAC2E33}\Proton Drive Setup 3.0.3 (9a6f9411) (x64).exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260729015427.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260729015427.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1
          2⤵
          • Adds Run key to start application
          • Enumerates connected drives
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2804
          • C:\Windows\TEMP\{2E62C62A-B566-4D8C-8520-3CDECDED5FF2}\.ba\wixprqba.exe
            "C:\Windows\TEMP\{2E62C62A-B566-4D8C-8520-3CDECDED5FF2}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{B20924E4-8853-4B1D-A3A1-9EDB3E6AAD88} {32954313-8975-4A62-991B-72D43059786C}
            3⤵
            • Executes dropped EXE
            PID:4136
          • C:\Windows\TEMP\{2E62C62A-B566-4D8C-8520-3CDECDED5FF2}\.ba\wixiuiba.exe
            "C:\Windows\TEMP\{2E62C62A-B566-4D8C-8520-3CDECDED5FF2}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{93EEF630-4719-4AD0-AF2A-C3B098E254D5} {E06758EC-7C11-47CF-AAA2-1F93F43FEAF8}
            3⤵
            • Executes dropped EXE
            PID:424
      • C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.NrptWatchdog.exe
        "C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.NrptWatchdog.exe"
        1⤵
        • Executes dropped EXE
        PID:4860
      • C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe
        "C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe" -quiet
        1⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5100
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:3440
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3352
          • C:\Windows\explorer.exe
            explorer.exe /LOADSAVEDWINDOWS
            2⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Drops desktop.ini file(s)
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4504
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\InvokeConvertFrom.xhtml
              3⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Modifies data under HKEY_USERS
              • Modifies registry class
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of WriteProcessMemory
              PID:3436
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb73bcc188,0x7ffb73bcc194,0x7ffb73bcc1a0
                4⤵
                  PID:4048
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,959178857650236215,2290303653857326765,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
                  4⤵
                  • Downloads MZ/PE file
                  • System Time Discovery
                  PID:5464
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,6151173620959980631,4204576256475719600,262144 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
                  4⤵
                    PID:2792
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2792,i,15411473605353330767,17761988043023944205,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:13
                    4⤵
                      PID:5484
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,4430652755700890645,3170738966859576574,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                      4⤵
                        PID:2868
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,16179653623017087399,3753168009902770925,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
                        4⤵
                          PID:5272
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,649548409669752462,9733425030307027069,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
                          4⤵
                            PID:1956
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,3019031568134979553,4050843121064482333,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:9
                            4⤵
                              PID:4740
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,13638928408246976656,10346102074635890753,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
                              4⤵
                                PID:476
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,10614199687013495885,13390052999377068757,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
                                4⤵
                                  PID:1492
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,12302409679658428137,1474873725374295614,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
                                  4⤵
                                    PID:3216
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,5819961558899923721,7153225705809667767,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
                                    4⤵
                                      PID:3084
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,5819961558899923721,7153225705809667767,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
                                      4⤵
                                        PID:760
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,481826529359568611,5879290359657368112,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
                                        4⤵
                                          PID:5876
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,18402048360319091783,3517617389772241322,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
                                          4⤵
                                            PID:5432
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,482951016308609488,15315870701867928754,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
                                            4⤵
                                              PID:1108
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2216916120732416226,2423402136495756476,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
                                              4⤵
                                                PID:3084
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,7543334033857874013,6556261646776936996,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
                                                4⤵
                                                  PID:2180
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,8957962161319324944,12429198125332359631,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
                                                  4⤵
                                                    PID:5740
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,9517309528551431127,8351988080465037678,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:14
                                                    4⤵
                                                      PID:4220
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,1266213799705973276,11023999789820436586,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
                                                      4⤵
                                                        PID:952
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,17350775930232727061,17102635461943868984,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:14
                                                        4⤵
                                                          PID:4508
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5708,i,2492528638877723785,5541354220262545293,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
                                                          4⤵
                                                            PID:5112
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5368,i,13930489928221647362,3944083559102516826,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
                                                            4⤵
                                                              PID:3448
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=1936,i,1085534900079707141,771355307097443208,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
                                                              4⤵
                                                                PID:1664
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,14252319635098570966,7846844332304877966,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:14
                                                                4⤵
                                                                  PID:4640
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3900,i,9708803208133831774,16768077427464111313,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:1
                                                                  4⤵
                                                                    PID:5124
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,11393327854939235850,15657161701730379582,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
                                                                    4⤵
                                                                      PID:2532
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7140,i,7435924266187016943,6229606245892014102,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:1
                                                                      4⤵
                                                                        PID:2136
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,18385508126642757422,7238028544354460244,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:14
                                                                        4⤵
                                                                          PID:3244
                                                                        • C:\Users\Admin\Downloads\ProtectorBot.exe
                                                                          "C:\Users\Admin\Downloads\ProtectorBot.exe"
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:1332
                                                                          • C:\Users\Admin\Downloads\ProtectorBot.exe
                                                                            "C:\Users\Admin\Downloads\ProtectorBot.exe"
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            PID:4116
                                                                        • C:\Users\Admin\Downloads\ProtectorBot.exe
                                                                          "C:\Users\Admin\Downloads\ProtectorBot.exe"
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:4900
                                                                          • C:\Users\Admin\Downloads\ProtectorBot.exe
                                                                            "C:\Users\Admin\Downloads\ProtectorBot.exe"
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            PID:3364
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,13778270616370847436,6809570807119234316,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
                                                                          4⤵
                                                                            PID:1152
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,12517359027803424389,4199790684665153734,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
                                                                            4⤵
                                                                              PID:5836
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4772,i,16580004857622950382,4629296683413617479,262144 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:10
                                                                              4⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:3152
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,15280776158925928736,17341331025353532729,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
                                                                              4⤵
                                                                                PID:2300
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5488,i,300663527751969149,16005076524265372521,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:1
                                                                                4⤵
                                                                                  PID:5092
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7164,i,1839734540431880185,1604380935565903335,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=1476 /prefetch:1
                                                                                  4⤵
                                                                                    PID:256
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=6500,i,10852363974019803297,17628622413447997639,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
                                                                                    4⤵
                                                                                      PID:4956
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,14988112447920963387,16993838159203965233,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:14
                                                                                      4⤵
                                                                                        PID:5632
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\build_exe.bat" "
                                                                                        4⤵
                                                                                        • Executes a command shell one-liner
                                                                                        PID:1808
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,14619517904518533548,8536157300981579421,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:14
                                                                                        4⤵
                                                                                          PID:2428
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,15604654958981689674,12781375961407115806,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:14
                                                                                          4⤵
                                                                                            PID:5820
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7648,i,12322142617257079787,15243044604585135256,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:14
                                                                                            4⤵
                                                                                              PID:2340
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7980,i,9292957248141712762,12160474040842746644,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:14
                                                                                              4⤵
                                                                                                PID:5728
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=1240,i,16835841230956534654,10697851707952960312,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
                                                                                                4⤵
                                                                                                  PID:3408
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7456,i,7973519295461939610,12853590649330354253,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:1
                                                                                                  4⤵
                                                                                                    PID:5756
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7432,i,8137293516534713231,11836728448470499728,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
                                                                                                    4⤵
                                                                                                      PID:4700
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1240,i,11792071443589707692,4777797123294669395,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:14
                                                                                                      4⤵
                                                                                                        PID:4404
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7948,i,11672292886318468014,13024867529598247992,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:14
                                                                                                        4⤵
                                                                                                          PID:4032
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1476,i,7329496123111969906,15109464992545110164,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:14
                                                                                                          4⤵
                                                                                                            PID:2148
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=6964,i,9763009640770809356,17786616490710750248,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:4988
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=6992,i,12324883117992555393,7773924014938163172,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
                                                                                                              4⤵
                                                                                                                PID:2732
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=1300,i,111790835694256389,10030126594584176253,2097152 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:5912
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7868,i,9752265920827027503,2455931510961218599,524288 --field-trial-handle=2428,i,10733451123989641990,642118941840431858,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
                                                                                                                  4⤵
                                                                                                                    PID:5044
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                                    4⤵
                                                                                                                    • Enumerates system info in registry
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                    PID:4664
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ffb73bcc188,0x7ffb73bcc194,0x7ffb73bcc1a0
                                                                                                                      5⤵
                                                                                                                        PID:5660
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,16759398439398470776,6215439298841401783,262144 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
                                                                                                                        5⤵
                                                                                                                          PID:5076
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,16573475188402282284,5500526776758535932,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
                                                                                                                          5⤵
                                                                                                                          • System Time Discovery
                                                                                                                          PID:1924
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2708,i,10755324127940159625,7856484217715818402,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:13
                                                                                                                          5⤵
                                                                                                                            PID:5768
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,5849455042673931559,11210408189311943887,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
                                                                                                                            5⤵
                                                                                                                              PID:3592
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,5849455042673931559,11210408189311943887,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
                                                                                                                              5⤵
                                                                                                                                PID:996
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1228,i,3617313590472423914,5194466279587848426,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=1364 /prefetch:14
                                                                                                                                5⤵
                                                                                                                                  PID:2604
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,16627037650718043401,17938665266302126648,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
                                                                                                                                  5⤵
                                                                                                                                    PID:2792
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,8332747576381940114,9622616941080568004,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
                                                                                                                                    5⤵
                                                                                                                                      PID:4896
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5020,i,4879684637913704108,3062756410995892018,2097152 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
                                                                                                                                      5⤵
                                                                                                                                        PID:1060
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5024,i,13418649403680789067,2875804961427622499,2097152 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
                                                                                                                                        5⤵
                                                                                                                                          PID:1360
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,2976835656343484735,6703136000515353678,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
                                                                                                                                          5⤵
                                                                                                                                            PID:476
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,2982912317832622285,9308980660990997955,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
                                                                                                                                            5⤵
                                                                                                                                              PID:5252
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,4526915310039434962,2396455174488781837,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
                                                                                                                                              5⤵
                                                                                                                                                PID:1236
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,3985332876432646998,12184473055833837138,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
                                                                                                                                                5⤵
                                                                                                                                                  PID:2880
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,2759721169489834735,5987037810802105498,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
                                                                                                                                                  5⤵
                                                                                                                                                    PID:4456
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,13832201135600612895,18311712363086258287,524288 --field-trial-handle=2352,i,10245613470454542971,4557999956451428682,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4680
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\ShieldPy-Antivirus\shieldpy\build_exe.bat" "
                                                                                                                                                  3⤵
                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                  PID:3208
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\InvokeConvertFrom.xhtml
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4028
                                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                1⤵
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:1984
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                1⤵
                                                                                                                                                • Modifies registry class
                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                PID:4620
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                1⤵
                                                                                                                                                  PID:964
                                                                                                                                                • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                  \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4928
                                                                                                                                                  • C:\Windows\System32\rundll32.exe
                                                                                                                                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2520
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:5836

                                                                                                                                                      Network

                                                                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                                                                            Reconnaissance

                                                                                                                                                            Resource Development

                                                                                                                                                            Initial Access

                                                                                                                                                            Execution

                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                            1
                                                                                                                                                            T1059

                                                                                                                                                            Windows Command Shell

                                                                                                                                                            1
                                                                                                                                                            T1059.003

                                                                                                                                                            Persistence

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            2
                                                                                                                                                            T1547

                                                                                                                                                            Active Setup

                                                                                                                                                            1
                                                                                                                                                            T1547.014

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1547.001

                                                                                                                                                            Event Triggered Execution

                                                                                                                                                            1
                                                                                                                                                            T1546

                                                                                                                                                            Component Object Model Hijacking

                                                                                                                                                            1
                                                                                                                                                            T1546.015

                                                                                                                                                            Privilege Escalation

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            2
                                                                                                                                                            T1547

                                                                                                                                                            Active Setup

                                                                                                                                                            1
                                                                                                                                                            T1547.014

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1547.001

                                                                                                                                                            Event Triggered Execution

                                                                                                                                                            1
                                                                                                                                                            T1546

                                                                                                                                                            Component Object Model Hijacking

                                                                                                                                                            1
                                                                                                                                                            T1546.015

                                                                                                                                                            Defense Evasion

                                                                                                                                                            Modify Registry

                                                                                                                                                            3
                                                                                                                                                            T1112

                                                                                                                                                            Credential Access

                                                                                                                                                            Unsecured Credentials

                                                                                                                                                            1
                                                                                                                                                            T1552

                                                                                                                                                            Credentials In Files

                                                                                                                                                            1
                                                                                                                                                            T1552.001

                                                                                                                                                            Discovery

                                                                                                                                                            Browser Information Discovery

                                                                                                                                                            1
                                                                                                                                                            T1217

                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                            2
                                                                                                                                                            T1120

                                                                                                                                                            Query Registry

                                                                                                                                                            6
                                                                                                                                                            T1012

                                                                                                                                                            System Information Discovery

                                                                                                                                                            5
                                                                                                                                                            T1082

                                                                                                                                                            System Location Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614

                                                                                                                                                            System Language Discovery

                                                                                                                                                            1
                                                                                                                                                            T1614.001

                                                                                                                                                            System Time Discovery

                                                                                                                                                            1
                                                                                                                                                            T1124

                                                                                                                                                            Lateral Movement

                                                                                                                                                            Collection

                                                                                                                                                            Data from Local System

                                                                                                                                                            1
                                                                                                                                                            T1005

                                                                                                                                                            Command and Control

                                                                                                                                                            Web Service

                                                                                                                                                            1
                                                                                                                                                            T1102

                                                                                                                                                            Exfiltration

                                                                                                                                                            Impact

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            e5a789f.rbs
                                                                                                                                                            • Path C:\Config.Msi\e5a789f.rbs
                                                                                                                                                            • Size 21KB
                                                                                                                                                            • SHA256 b647c2e144fc7261e06bfe54e7711e768d3c13ac147a86201d3d5c16fa4560a7
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            e5a78a3.rbs
                                                                                                                                                            • Path C:\Config.Msi\e5a78a3.rbs
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 a05f925b554d3cda365187724ef3d77d23283d97524b1de07ea384698a2ba173
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonVPN.Launcher.exe
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
                                                                                                                                                            • Size 17.9MB
                                                                                                                                                            • SHA256 c2795771df5f5eb60b8d77877a7f04d973137aed52ba474b2adb0a966400431d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            CoreMessagingXP.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\CoreMessagingXP.dll
                                                                                                                                                            • Size 1018KB
                                                                                                                                                            • SHA256 2b1d604460a7d44b5e555e9e3068785b96287b034cb120ecc3290fb70260c762
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Microsoft.Internal.FrameworkUdk.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\Microsoft.Internal.FrameworkUdk.dll
                                                                                                                                                            • Size 905KB
                                                                                                                                                            • SHA256 51dc87180623b78bcd4933bfbc40ea7bd42efc25a3e5c2b34a47c850a7d0a805
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Microsoft.UI.Windowing.Core.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\Microsoft.UI.Windowing.Core.dll
                                                                                                                                                            • Size 530KB
                                                                                                                                                            • SHA256 ca0015abf1533f2f3357c8a6480a6ceb2adda66810f0d5d257da33ef13e3315c
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Microsoft.UI.Xaml.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\Microsoft.UI.Xaml.dll
                                                                                                                                                            • Size 14.3MB
                                                                                                                                                            • SHA256 f4084263744c5dd5c37cc7dbd1f6a26ad7acf989e306184359b4377f3435319b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Microsoft.WinUI.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\Microsoft.WinUI.dll
                                                                                                                                                            • Size 7.0MB
                                                                                                                                                            • SHA256 b745cc38595f48f6b33c02eefc5d5df15a7759ea9e918ce1c18ddf3eb050ce38
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Microsoft.WindowsAppRuntime.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\Microsoft.WindowsAppRuntime.dll
                                                                                                                                                            • Size 2.2MB
                                                                                                                                                            • SHA256 8d593c4374b193b18ba37b8be8cce093ae4f247423c127ee9c09a63ded3dbb64
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonInstaller.exe
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonInstaller.exe
                                                                                                                                                            • Size 6.0MB
                                                                                                                                                            • SHA256 0e0ca31d330f3e428dbb82605357fafeef75e6f3442067449761f5f71d2a1179
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonVPN.Client.deps.json
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.Client.deps.json
                                                                                                                                                            • Size 566KB
                                                                                                                                                            • SHA256 d9cdf7762431278a8a3f3cb9febb30deecc0da5b075f9c8e89628fada9879fc1
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonVPN.Client.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.Client.dll
                                                                                                                                                            • Size 3.0MB
                                                                                                                                                            • SHA256 96d695ee578317a594fbb240b6ffb86cb005bc4a7d2eccdbb0f27eaa14760b3f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonVPN.Client.exe
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.Client.exe
                                                                                                                                                            • Size 590KB
                                                                                                                                                            • SHA256 5f72dd314eebec51d0271259e1388bce7365f22fed450ae27efdeaf1716ecda5
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonVPN.Common.Core.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.Common.Core.dll
                                                                                                                                                            • Size 72KB
                                                                                                                                                            • SHA256 bfc8b92cff28777b47580f131959d4a1df4140ae820d5d6b93963b79f61f5e3f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonVPNService.deps.json
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.deps.json
                                                                                                                                                            • Size 390KB
                                                                                                                                                            • SHA256 42c99f247433c80cd44cbfac1889547d93f01d5a8d960bb57f95768b2a13587d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonVPNService.exe
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.exe
                                                                                                                                                            • Size 466KB
                                                                                                                                                            • SHA256 153699e8ba64fdc1763b39aa5c877dbe227c7e5b250811b8c39e7ea671051e7f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonVPNService.runtimeconfig.json
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.runtimeconfig.json
                                                                                                                                                            • Size 629B
                                                                                                                                                            • SHA256 becb5e7dbe360a21ec893d5fbed565339094204adeb595a83cb2541e0fc99cb9
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Sentry.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\Sentry.dll
                                                                                                                                                            • Size 787KB
                                                                                                                                                            • SHA256 15011a9f08363a311e141b2768cd39e04a49486a2477e3d4274f588f94c86823
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            System.Collections.Concurrent.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\System.Collections.Concurrent.dll
                                                                                                                                                            • Size 269KB
                                                                                                                                                            • SHA256 0b1545071db0e5e918035aa7103bf8864d504099c6083bed5db94f8657711d74
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            System.Collections.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\System.Collections.dll
                                                                                                                                                            • Size 253KB
                                                                                                                                                            • SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            System.Linq.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\System.Linq.dll
                                                                                                                                                            • Size 529KB
                                                                                                                                                            • SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            System.Memory.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\System.Memory.dll
                                                                                                                                                            • Size 153KB
                                                                                                                                                            • SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            System.ObjectModel.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\System.ObjectModel.dll
                                                                                                                                                            • Size 77KB
                                                                                                                                                            • SHA256 62e0cd6e1585a1f5cd153e2832a03b6dafac0e0ab3331048e7f7bd3dd692f9c4
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            System.Private.CoreLib.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\System.Private.CoreLib.dll
                                                                                                                                                            • Size 12.6MB
                                                                                                                                                            • SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            System.Runtime.CompilerServices.Unsafe.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\System.Runtime.CompilerServices.Unsafe.dll
                                                                                                                                                            • Size 14KB
                                                                                                                                                            • SHA256 13978df865f57310a6fd2a68b6b7c8c3add3e7d222335f191998429c65ebd7c7
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            System.Runtime.InteropServices.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\System.Runtime.InteropServices.dll
                                                                                                                                                            • Size 93KB
                                                                                                                                                            • SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            System.Runtime.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\System.Runtime.dll
                                                                                                                                                            • Size 42KB
                                                                                                                                                            • SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            System.Threading.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\System.Threading.dll
                                                                                                                                                            • Size 81KB
                                                                                                                                                            • SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            WinRT.Runtime.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\WinRT.Runtime.dll
                                                                                                                                                            • Size 516KB
                                                                                                                                                            • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            clrjit.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\clrjit.dll
                                                                                                                                                            • Size 1.7MB
                                                                                                                                                            • SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            coreclr.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\coreclr.dll
                                                                                                                                                            • Size 4.8MB
                                                                                                                                                            • SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            hostfxr.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\hostfxr.dll
                                                                                                                                                            • Size 357KB
                                                                                                                                                            • SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            hostpolicy.dll
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\hostpolicy.dll
                                                                                                                                                            • Size 397KB
                                                                                                                                                            • SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            is-1AV5KS2MFF.tmp
                                                                                                                                                            • Path C:\Program Files\Proton\VPN\v5.1.5\is-1AV5KS2MFF.tmp
                                                                                                                                                            • Size 245KB
                                                                                                                                                            • SHA256 60f195a13bf0e240ca9615cb98cdfd25f0875905b839ff2b796c9cadba0ff8af
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            008ea53b-b563-4a74-b13b-c8cdaaf03b54.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\008ea53b-b563-4a74-b13b-c8cdaaf03b54.tmp
                                                                                                                                                            • Size 35KB
                                                                                                                                                            • SHA256 f2c6c10866319667ee56a29366ecb7200ad82faf9fc04abc12e7975ae325c789
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 2b569abebbaaf26f699fc69b66ce0f336d08065af2ccdaaca5421accc53b1c38
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 f6967b295d14519f0b63dd57145c2a1f9245df5d3d661efe1079eb9376919dab
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            settings.dat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                            • Size 280B
                                                                                                                                                            • SHA256 83eb45cba5b79021a2b112789d942dce4384cef63672e2b716dd59f901df70eb
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            08f8d101-bbf2-4050-a36d-25a0b89f2bda.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\08f8d101-bbf2-4050-a36d-25a0b89f2bda.tmp
                                                                                                                                                            • Size 6B
                                                                                                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            22ba719f-2a73-4230-b3a9-46a410c7d3da.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22ba719f-2a73-4230-b3a9-46a410c7d3da.tmp
                                                                                                                                                            • Size 414B
                                                                                                                                                            • SHA256 fca830dd71e6e0470b76d915c22b2221873dabe4ec9bfd5489b5f659a0c1e1c8
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            LOG.old
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                            • Size 334B
                                                                                                                                                            • SHA256 e741bbd3ab5c52f156ebed2c87565f774fdc6e74b12ff17b7db5c798f7ad6d49
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            LOG.old
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                            • Size 331B
                                                                                                                                                            • SHA256 5881d83d0d32688d2c4a17722aa481f8ac2558236348c0d9cd484c34929a4ccb
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 f0ad738343776ecfbf56ce0e82fd037e07c0f80c1798145d405395171e9f2bfb
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 f32b74ffb2e671e0061ae65ca64f679031f2fa5ba65709881b1cfad99bcce704
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 493b571c9e7894da5820e53afea8561fa98b7f9204db83190c90f42bafbce94b
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 df2b0f6dc21d2cc7c140bec845c5d383a4e9ce96dd48e96956763a8ca10d0f37
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            the-real-index~RFe6194bd.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe6194bd.TMP
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 1546c5684effee5dba43a8190683a53ee897a149e838c50fb08c7ae24b723ca5
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            data_1
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                                                                                                            • Size 264KB
                                                                                                                                                            • SHA256 efc3fe46afcf9d11b7b08903f0bc5b66290de15ae3a8c79c37209a4be80ec080
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            SiteList-Enterprise.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                            • Size 2B
                                                                                                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Edge Profile.ico
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                            • Size 70KB
                                                                                                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Network Persistent State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 e80419844b93d7c378f3ba14f83d9a4e5fed664f55900f95eb2cecfd66d7a837
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Network Persistent State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 c9eb44ef5de5108711d625d4c8935ca388902896d9fd18809bfcff9e956709ff
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            SCT Auditing Pending Reports
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                            • Size 2B
                                                                                                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Sdch Dictionaries
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                            • Size 40B
                                                                                                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                            • Size 13KB
                                                                                                                                                            • SHA256 f3c0882b9ce5519d0064934b7c282946be516ff287d062ad2af558e939624d87
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                            • Size 11KB
                                                                                                                                                            • SHA256 bcdd92029a8a741f70ce496c02e75e28e442e4e6c9453a6b95bf934bcd7f39d6
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                            • Size 12KB
                                                                                                                                                            • SHA256 595f0367133457c470549d9bab095587681c29274245ffa7cf608086a37bfb61
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                            • Size 11KB
                                                                                                                                                            • SHA256 5e88f998967c4ab75b3ef6e7547549885445bda585befb16d4dcfe3e63056da9
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                            • Size 11KB
                                                                                                                                                            • SHA256 f9bed0000513b674c2e581a8406c77dee2acff4af04d8dbaa87a0116774cc56f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                            • Size 13KB
                                                                                                                                                            • SHA256 98ad8d9f0bb55d6a1515facf29895b5197b103c05d4d48dbbd11b481e660a9c9
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Secure Preferences
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                            • Size 29KB
                                                                                                                                                            • SHA256 3940407a42d20bbbedfc7081b058ba09e633879ab89a4a1c715deea05959e1f2
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            sync_diagnostic.log
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                            • Size 4KB
                                                                                                                                                            • SHA256 eb49110e975dd91cae5a6d9ddc60e2850f6c6a5ddabb6d436637a3579e6f4edb
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            OperationConfig
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                            • Size 22KB
                                                                                                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            OperationConfig~RFe6230ce.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe6230ce.TMP
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 44KB
                                                                                                                                                            • SHA256 455e48a602f213bce5ce7c0e3f4d9a9b592c957a7d59e2d083aec1ee2e967663
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 44KB
                                                                                                                                                            • SHA256 c1e27e06aa3cb46b78f0ca171220c242a45b6adfd958b592fa569343c1f78b98
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 35KB
                                                                                                                                                            • SHA256 2a67c700d107da815f77c2b213daf6529f8cf1396deed85bc03d77765d916ee2
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 43KB
                                                                                                                                                            • SHA256 b8e2a55c4e552d122e14d9e74d12bd852bff4ecf7aa31764bb7a0b527d27a0fb
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 49KB
                                                                                                                                                            • SHA256 292d37534bfede1da27df4a462efab28a8ca10b4bcbf88beb4e88cdc8ec3695d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 38KB
                                                                                                                                                            • SHA256 e2029ed6ddf3b17402d0e9a96b931fab1d76f051125083b591b36e4433ba62a0
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 44KB
                                                                                                                                                            • SHA256 015d19bba2e20aa4d9e0bdc494477cb45f1288ed757c22a396ad853ec48eb6aa
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Local State
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                            • Size 44KB
                                                                                                                                                            • SHA256 a3f04e5148b5545cac74cee3719ea7111e5ae3d5a28816bceb5496d494d12c3f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                            • Size 392B
                                                                                                                                                            • SHA256 78fae056caaca8d0b6afc54b3e8724644e440b08c4656cf0a0b0ea53c77a5ae6
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                            • Size 392B
                                                                                                                                                            • SHA256 fa1cd0fee8f5ba830ffaedd319b50652489279c5920b86bb55285bc992799eff
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                            • Size 392B
                                                                                                                                                            • SHA256 b4a62a2cc4d0a35ee57b59afa0f157ebef7a87317ede73009f20b8b804ea3776
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                            • Size 392B
                                                                                                                                                            • SHA256 384c222d7e53b7a70fdc52f5617582dcecf24aff670c5e44bbc4368d17322cca
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            RevisitationBloomfilter
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                            • Size 392B
                                                                                                                                                            • SHA256 c5754d7ccf62f97ece2fdd74c6b0884c57ad5aedf5174c1caafa74ebd2a9bfdc
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            RevisitationBloomfilter~RFe633686.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe633686.TMP
                                                                                                                                                            • Size 392B
                                                                                                                                                            • SHA256 4c272f4b0c7e3d65a14d21010a7f17fe66e0c4014f93664c0e378333c677adf3
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 132B
                                                                                                                                                            • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 252B
                                                                                                                                                            • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 372B
                                                                                                                                                            • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 492B
                                                                                                                                                            • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 612B
                                                                                                                                                            • SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 972B
                                                                                                                                                            • SHA256 6bbc409c6c8e5287723de210e3463bc9873d0adfd3542a753ad8169fa6342edd
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                            • Size 732B
                                                                                                                                                            • SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            26bff236-8190-43ee-9130-ed89b34b4db6.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\26bff236-8190-43ee-9130-ed89b34b4db6.tmp
                                                                                                                                                            • Size 13B
                                                                                                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                            • Size 153KB
                                                                                                                                                            • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            metadata.json~RFe616b6b.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe616b6b.TMP
                                                                                                                                                            • Size 132B
                                                                                                                                                            • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            iconcache_idx.db
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                                            • Size 56KB
                                                                                                                                                            • SHA256 3da0ddfe852639182c002f99bb5b0a0a8b9eb5c9a14575a2e18b427f277465c8
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            iconcache_idx.db
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                                            • Size 56KB
                                                                                                                                                            • SHA256 851b4722aff42586b169950a84615113aaf198635f93ad205a7db41c0d09c3d9
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                            • Size 607B
                                                                                                                                                            • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            a44ed104-b53a-41e4-82a8-fe62d963c35d.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\a44ed104-b53a-41e4-82a8-fe62d963c35d.tmp
                                                                                                                                                            • Size 1B
                                                                                                                                                            • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonVPN.InstallActions.x86.dll
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\is-MHCVCGXZ53.tmp\ProtonVPN.InstallActions.x86.dll
                                                                                                                                                            • Size 460KB
                                                                                                                                                            • SHA256 fb1eddad17872e203e5e1a2753f5ce94e6dc67748b11634cd2f83c1fe191d86e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            VC_redist.x64.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\is-MHCVCGXZ53.tmp\VC_redist.x64.exe
                                                                                                                                                            • Size 17.7MB
                                                                                                                                                            • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtonVPN_v5.1.5_x64.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\is-QMPL1S0C67.tmp\ProtonVPN_v5.1.5_x64.tmp
                                                                                                                                                            • Size 3.8MB
                                                                                                                                                            • SHA256 732f673f6ae635d9734b8a48915ed98bb6f9ae0f2d1be6c9d8a1365a886e6b8f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            content_new.js
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3436_1374918473\CRX_INSTALL\content_new.js
                                                                                                                                                            • Size 10KB
                                                                                                                                                            • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            squirrel.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\squirrel.exe
                                                                                                                                                            • Size 2.1MB
                                                                                                                                                            • SHA256 578779193ceb774e78b5ff53d41a6b6a247f91b5873dc7424bdc81e85a8059aa
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            default.exc
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                                                                                                                                                            • Size 2B
                                                                                                                                                            • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            f01b4d95cf55d32a.automaticDestinations-ms
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                                                                                                                                            • Size 9KB
                                                                                                                                                            • SHA256 032e6f4d9df8f5024cf30322a1d43552ced6d80d77449bdbd73398f0f4ee839d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            f01b4d95cf55d32a.automaticDestinations-ms
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                                                                                                                                            • Size 9KB
                                                                                                                                                            • SHA256 ac847ad7991881a898ddbd65944bcfb85ffd52682b22340b6c6f2c75ce0e646a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Proton Drive.lnk
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 5312be2e543ebafe40b7307601e06c8e5ec468185d5f10c23efee5979cec6bb8
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Proton Drive.lnk~RFe5a982a.TMP
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk~RFe5a982a.TMP
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 0ce29ac491c3a2d25f1b24a6f3fd7d85578aa8a6e7c129a78b31a132be7e51b1
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            5974d31a-850f-4591-86e8-b50f190da46b.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\5974d31a-850f-4591-86e8-b50f190da46b.tmp
                                                                                                                                                            • Size 93B
                                                                                                                                                            • SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            94d27e17-7b49-4fc1-8a6a-e0d018b21b5d.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Network\94d27e17-7b49-4fc1-8a6a-e0d018b21b5d.tmp
                                                                                                                                                            • Size 111B
                                                                                                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            index
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\Code Cache\js\index
                                                                                                                                                            • Size 24B
                                                                                                                                                            • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            MANIFEST-000001
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\Local Storage\leveldb\MANIFEST-000001
                                                                                                                                                            • Size 41B
                                                                                                                                                            • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            CURRENT
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\Local Storage\leveldb\CURRENT
                                                                                                                                                            • Size 16B
                                                                                                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            config.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
                                                                                                                                                            • Size 217B
                                                                                                                                                            • SHA256 a6bf6b7681c56a97580fb996ae92e3fad690d9c989c6e8ca4c7d8359243dae55
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            config.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
                                                                                                                                                            • Size 396B
                                                                                                                                                            • SHA256 4fe0bbd09e0341c383a2ebafc838b3d1ddf9f3191ef0fdb508cd3ab6f7a0cf04
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            config.json
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
                                                                                                                                                            • Size 457B
                                                                                                                                                            • SHA256 80e05ce029352e804cd6a5235131365e6b7e7a5c94f5ae33a82f1d77f6adfe9c
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            main.log
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 fb22dedc807a6ec751b8f34a824a93416fedabae3d073dee09b7b6b28358c4af
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            main.log
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
                                                                                                                                                            • Size 3KB
                                                                                                                                                            • SHA256 bffad3dea6c228911ddca6fd924635d5ab998bde936c0f9ceb42f02cf876ae76
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Proton Drive.lnk
                                                                                                                                                            • Path C:\Users\Admin\Desktop\Proton Drive.lnk
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 d8e94951b1ebdeeb0a3ff27451988271a06aa47afda740f92474cd452ada6eda
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Proton Drive.lnk~RFe5a99ef.TMP
                                                                                                                                                            • Path C:\Users\Admin\Desktop\Proton Drive.lnk~RFe5a99ef.TMP
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 97db14d111ecd05e961bf22de34a374edef6e718ce6af5da075660e0a74a3059
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            AiAtron.exe.crdownload
                                                                                                                                                            • Path C:\Users\Admin\Downloads\AiAtron.exe.crdownload
                                                                                                                                                            • Size 9.1MB
                                                                                                                                                            • SHA256 fbfdb9a7a446a8e8690469749933570c92c08fd5bfcfc011de8172de55996d8d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ProtectorBot.exe
                                                                                                                                                            • Path C:\Users\Admin\Downloads\ProtectorBot.exe
                                                                                                                                                            • Size 31.0MB
                                                                                                                                                            • SHA256 8599020563cef749ff0036757eece2eb50a47f5cac37932ad5d5ddd0410fb83c
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            ShieldPy-Antivirus.zip.crdownload
                                                                                                                                                            • Path C:\Users\Admin\Downloads\ShieldPy-Antivirus.zip.crdownload
                                                                                                                                                            • Size 49KB
                                                                                                                                                            • SHA256 492a60baa7b459f823078afa1eb86eeddec41c7b922349b2c53b1e13b95fc711
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            generate_icon.py
                                                                                                                                                            • Path C:\Users\Admin\Downloads\ShieldPy-Antivirus\shieldpy\assets\generate_icon.py
                                                                                                                                                            • Size 2KB
                                                                                                                                                            • SHA256 b41d1d2fdeaed3d2db60b967bf26597a68be978e2156eb794f992c3dad7be582
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            build_exe.bat
                                                                                                                                                            • Path C:\Users\Admin\Downloads\build_exe.bat
                                                                                                                                                            • Size 739B
                                                                                                                                                            • SHA256 c748ec2d6558d420e67064a0f52eb6b9d57007dadb912e66818f43e7333015e6
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            MSI836C.tmp
                                                                                                                                                            • Path C:\Windows\Installer\MSI836C.tmp
                                                                                                                                                            • Size 322KB
                                                                                                                                                            • SHA256 40ed9ccc29563af85791dc2817811b1061829d4dedd56e0c60e08c26abaf2b60
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            MSI85D0.tmp
                                                                                                                                                            • Path C:\Windows\Installer\MSI85D0.tmp
                                                                                                                                                            • Size 390KB
                                                                                                                                                            • SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            CustomAction.config
                                                                                                                                                            • Path C:\Windows\Installer\SFXCA5638616C824E90DA1146EC43DAAAFD98\CustomAction.config
                                                                                                                                                            • Size 959B
                                                                                                                                                            • SHA256 7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            Proton.Drive.Installer.Extensions.dll
                                                                                                                                                            • Path C:\Windows\Installer\SFXCA5638616C824E90DA1146EC43DAAAFD98\Proton.Drive.Installer.Extensions.dll
                                                                                                                                                            • Size 7KB
                                                                                                                                                            • SHA256 b454d0bfd0b0b84bcfea2b30309c96e928dcd7aa00b3306e7a77bad6992c0007
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            WixToolset.Dtf.WindowsInstaller.dll
                                                                                                                                                            • Path C:\Windows\Installer\SFXCA5638616C824E90DA1146EC43DAAAFD98\WixToolset.Dtf.WindowsInstaller.dll
                                                                                                                                                            • Size 193KB
                                                                                                                                                            • SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            LICENSE
                                                                                                                                                            • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4664_715801858\LICENSE
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            VC_redist.x64.exe
                                                                                                                                                            • Path C:\Windows\Temp\{7E06B2AC-CBF2-4A17-A84C-D530A157C7EA}\.cr\VC_redist.x64.exe
                                                                                                                                                            • Size 615KB
                                                                                                                                                            • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            logo.png
                                                                                                                                                            • Path C:\Windows\Temp\{FEFBB30C-BDB0-42F6-9037-763347AFFF3C}\.ba\logo.png
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            wixstdba.dll
                                                                                                                                                            • Path C:\Windows\Temp\{FEFBB30C-BDB0-42F6-9037-763347AFFF3C}\.ba\wixstdba.dll
                                                                                                                                                            • Size 215KB
                                                                                                                                                            • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                            Submit Download

                                                                                                                                                            memory/1984-3073-0x00000210001E0000-0x00000210002E0000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1984-3087-0x00000210142C0000-0x00000210143C0000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1984-3119-0x00000210146E0000-0x0000021014700000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1984-3103-0x0000021004000000-0x0000021004020000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1984-3085-0x0000021001EA0000-0x0000021001EC0000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2636-2805-0x0000000000B70000-0x0000000000D48000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-21-0x0000000002F60000-0x0000000002F61000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-2506-0x0000000000710000-0x0000000000AF1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-955-0x0000000004220000-0x0000000004360000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-2485-0x0000000000710000-0x0000000000AF1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-2496-0x0000000000710000-0x0000000000AF1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-23-0x0000000000710000-0x0000000000AF1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-6-0x0000000002F60000-0x0000000002F61000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-954-0x0000000000710000-0x0000000000AF1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-2511-0x0000000000710000-0x0000000000AF1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-12-0x0000000004220000-0x0000000004360000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-20-0x0000000000710000-0x0000000000AF1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2712-24-0x0000000004220000-0x0000000004360000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/3364-6043-0x00007FFB7A9F0000-0x00007FFB7AA19000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/3400-2997-0x0000000000C70000-0x0000000000C90000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4116-4961-0x00007FFB7F250000-0x00007FFB7F279000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4504-6496-0x000000000AB20000-0x000000000ACDE000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4504-6803-0x000000000AB20000-0x000000000ACDE000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4504-6463-0x000000000AB20000-0x000000000ACDE000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4504-3322-0x000000000A290000-0x000000000A9B5000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4504-6505-0x000000000AB20000-0x000000000ACDE000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4504-6348-0x000000000AB20000-0x000000000ACDE000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4504-6593-0x000000000AB20000-0x000000000ACDE000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4504-6883-0x000000000AB20000-0x000000000ACDE000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4620-3246-0x000001AB6B000000-0x000001AB6B691000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4924-2620-0x000001E891240000-0x000001E891246000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/4924-2618-0x000001E893800000-0x000001E893834000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5512-2898-0x0000000000810000-0x0000000000A2E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5672-19-0x0000000000090000-0x00000000001B5000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5672-0-0x0000000000090000-0x00000000001B5000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/5672-2512-0x0000000000090000-0x00000000001B5000-memory.dmp
                                                                                                                                                            Download