Overview

overview

6

Static

static

1

ProtonVPN_...64.exe

windows11-21h2-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    63s
  • max time network
    81s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    20/08/2026, 04:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProtonVPN_v5.1.7_x64.exe
  • Size 124.1MB
  • Sample260820-e9ca5sen5t
  • SHA256 ab8c87d7db3cb76271df72186c1af0831362671b145acc449a8443a415379c8a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.7_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.7_x64.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Users\Admin\AppData\Local\Temp\is-VNXH6LJFGC.tmp\ProtonVPN_v5.1.7_x64.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-VNXH6LJFGC.tmp\ProtonVPN_v5.1.7_x64.tmp" /SL5="$A0070,128731564,1139200,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.7_x64.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4580
      • C:\Users\Admin\AppData\Local\Temp\is-VYYIWP3CC1.tmp\VC_redist.x64.exe
        "C:\Users\Admin\AppData\Local\Temp\is-VYYIWP3CC1.tmp\VC_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3136
        • C:\Windows\Temp\{A8F2A9EC-74A4-4E2E-AF41-FB1E27D8E15F}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{A8F2A9EC-74A4-4E2E-AF41-FB1E27D8E15F}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-VYYIWP3CC1.tmp\VC_redist.x64.exe" -burn.filehandle.attached=724 -burn.filehandle.self=728 /install /quiet /norestart
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2880
          • C:\Windows\Temp\{2C582C9C-14DD-4CB6-BB17-AEFC6DD0194C}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{2C582C9C-14DD-4CB6-BB17-AEFC6DD0194C}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{AA023193-AE35-4003-9972-CED16A402B56} {1879361E-B3A2-4C5B-9551-5F61694B0D93} 2880
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4620
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{021866C9-B997-4224-B660-6ABCDF9BB4D6} {A9D89C88-CEEE-41A4-899B-22377B151B2B} 4620
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2596
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=560 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1028 -burn.embedded BurnPipe.{021866C9-B997-4224-B660-6ABCDF9BB4D6} {A9D89C88-CEEE-41A4-899B-22377B151B2B} 4620
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1068
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{25004547-5CCE-4139-8C56-DB4DD98B911C} {DC5D48FC-A826-4E59-906D-9830044DC8C5} 1068
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:1920
      • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
        "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" -Language en-US -CleanInstall
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4456
        • C:\Program Files\Proton\VPN\v5.1.7\ProtonVPN.Client.exe
          "C:\Program Files\Proton\VPN\v5.1.7\ProtonVPN.Client.exe" -Language en-US -CleanInstall
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2388
  • C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.exe
    "C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.exe"
    1⤵
    • Executes dropped EXE
    PID:3308
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4800
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:1136
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4044
    • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
        "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260820053927.log" /install
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3364
        • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=552 -burn.filehandle.self=568 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260820053927.log" /install
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3260
          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{F0CC7961-2246-4250-ACCA-CD415ED4112B} {46821E0A-0972-4E85-B427-EF5EFBC6773E} 3260
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4572
    • C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.exe
      "C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.exe"
      1⤵
      • Executes dropped EXE
      PID:4480
      • C:\Program Files\Proton\VPN\v5.1.7\ProtonVPN.NrptWatchdog.exe
        "C:\Program Files\Proton\VPN\v5.1.7\ProtonVPN.NrptWatchdog.exe" --pid 4480
        2⤵
          PID:992
      • C:\Program Files\Proton\VPN\v5.1.7\ProtonVPN.NrptWatchdog.exe
        "C:\Program Files\Proton\VPN\v5.1.7\ProtonVPN.NrptWatchdog.exe"
        1⤵
          PID:4052

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e59295d.rbs
              • Path C:\Config.Msi\e59295d.rbs
              • Size 19KB
              • SHA256 b0e2494854110021d12ca9e2c4e5018d3b82e984ef5012b13a08ef138fc8c255
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e592969.rbs
              • Path C:\Config.Msi\e592969.rbs
              • Size 19KB
              • SHA256 c42c0bdb0658a38fcbda7dfe849b87361e7637aa54ff60c4dcdeb6ce8d220b58
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e592970.rbs
              • Path C:\Config.Msi\e592970.rbs
              • Size 21KB
              • SHA256 5ba0d619bb8fdc8de5c7de7329d1cce90c7c83b30cf29ac4ad2532b3b68771fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              e59297f.rbs
              • Path C:\Config.Msi\e59297f.rbs
              • Size 21KB
              • SHA256 9f560daed4be7c762136c87c7faf970a9f8b6744697d9bf8f2dbf48a64d124d7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ProtonVPN.Launcher.exe
              • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
              • Size 17.9MB
              • SHA256 bf83f90b2994d8f086459f80bba0c78281bd44130c3af4ea6ddc812268fb3d4f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.WinUI.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\Microsoft.WinUI.dll
              • Size 7.0MB
              • SHA256 b745cc38595f48f6b33c02eefc5d5df15a7759ea9e918ce1c18ddf3eb050ce38
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Microsoft.WindowsAppRuntime.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\Microsoft.WindowsAppRuntime.dll
              • Size 2.2MB
              • SHA256 8d593c4374b193b18ba37b8be8cce093ae4f247423c127ee9c09a63ded3dbb64
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ProtonVPN.Client.deps.json
              • Path C:\Program Files\Proton\VPN\v5.1.7\ProtonVPN.Client.deps.json
              • Size 532KB
              • SHA256 553987a5e4ac4ee58ee112a58fdd6197bdef99f64f5ff29e416641c7889742c3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ProtonVPN.Client.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\ProtonVPN.Client.dll
              • Size 3.0MB
              • SHA256 5aabf7c4acf72f0b2218555dcf702332e805cdd7e5c07ee79bd59100cdc40675
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ProtonVPN.Client.exe
              • Path C:\Program Files\Proton\VPN\v5.1.7\ProtonVPN.Client.exe
              • Size 590KB
              • SHA256 8a5a04752bacc84703552a068f77b9c3cb0926e3a83702a44595d2295c04cf5e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ProtonVPN.Common.Core.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\ProtonVPN.Common.Core.dll
              • Size 72KB
              • SHA256 55232398b8fc5e6a8d78dfc441d4205f2c4738e1423e4078f3cab85c5d33161e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ProtonVPNService.deps.json
              • Path C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.deps.json
              • Size 368KB
              • SHA256 59e4139e760853d26ac3cd777fe88f76d3df141fa187c77c62493835e888b5a0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ProtonVPNService.exe
              • Path C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.exe
              • Size 466KB
              • SHA256 2fb398f9d7b75bfad4c751d3d8b813871345c3982bd41eaad012f79e89c1a217
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ProtonVPNService.runtimeconfig.json
              • Path C:\Program Files\Proton\VPN\v5.1.7\ProtonVPNService.runtimeconfig.json
              • Size 629B
              • SHA256 3533261fd47a7c17c49346a1e536e497a9a69c986d9181fc625b14856edb7a05
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              Sentry.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\Sentry.dll
              • Size 787KB
              • SHA256 46750aa79fde11fb566d4b2d4d6148cc87a9a3c8d45e8a6f611fdba6fcdae1b1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Collections.Concurrent.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\System.Collections.Concurrent.dll
              • Size 269KB
              • SHA256 e7118198a3a8b22ca39685a273d05db7b4f6c73e35d8d4ce462f66173e61fa53
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Collections.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\System.Collections.dll
              • Size 253KB
              • SHA256 0937f7983c191dbb768c51bb9ae90621575c0a2cc3b185d85e31ac2f87001af2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Linq.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\System.Linq.dll
              • Size 529KB
              • SHA256 ad19451aa60c394640b7bf5950102f948c08b61b1d496e4f10d897449f4b18e4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Memory.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\System.Memory.dll
              • Size 153KB
              • SHA256 fd29c91ec1ae5ec2d98ad77f2863da6d583a3be596a1813959d02877cde057a0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Private.CoreLib.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\System.Private.CoreLib.dll
              • Size 12.6MB
              • SHA256 8c01f630bb23c2fb142e6559cdcdf147105625defb36107019d4ab50d8854cd3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Runtime.InteropServices.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\System.Runtime.InteropServices.dll
              • Size 93KB
              • SHA256 570a8140b838042a5d1135d5a20e39d18ccbfce13395c73b0b5bea935d311ea0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Runtime.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\System.Runtime.dll
              • Size 42KB
              • SHA256 f1b8629204b3363722bbd6219c4fd54096cf01d29db861412c287227c130decf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Threading.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\System.Threading.dll
              • Size 81KB
              • SHA256 baad7f0d2f3ef9a7b4ed7646093464edddbee0937f33de71be139a01a86375ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WinRT.Runtime.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\WinRT.Runtime.dll
              • Size 516KB
              • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              clrjit.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\clrjit.dll
              • Size 1.7MB
              • SHA256 4e8e72443ecee874c8dda010169b4556315d6c2f78a79165b5389e65b5a69f13
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              coreclr.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\coreclr.dll
              • Size 4.8MB
              • SHA256 048dce560f81bc412413c106ee29c82625b4a6eb0f278a31913b1ad7c0260f82
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              hostfxr.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\hostfxr.dll
              • Size 357KB
              • SHA256 0b644b231bf16b0af57abe66eee54bba22f42105f16b7fef327773c432b35426
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              hostpolicy.dll
              • Path C:\Program Files\Proton\VPN\v5.1.7\hostpolicy.dll
              • Size 397KB
              • SHA256 93b021e41c227d08be3fecdcdd958c71199bd05bb8383914806a9dc850d68bb3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-U46JZRS3OM.tmp
              • Path C:\Program Files\Proton\VPN\v5.1.7\is-U46JZRS3OM.tmp
              • Size 237KB
              • SHA256 1d99a14ae2322bf36f9fe6553df0c20911c9d11e9d4d849778f311e031b8427d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Setup Log 2026-08-20 #001.txt
              • Path C:\Users\Admin\AppData\Local\Temp\Setup Log 2026-08-20 #001.txt
              • Size 423KB
              • SHA256 638a30d72a88b01438e9b30c33427064a730198673ef03ddc1b4d8d95ac69870
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dd_vcredist_amd64_20260820053927.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260820053927.log
              • Size 12KB
              • SHA256 55851fe04da8505ae9e45b24ec69b6a30217153df4d5f13115abd0b9704a5af2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dd_vcredist_amd64_20260820053927_000_vcRuntimeMinimum_x64.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260820053927_000_vcRuntimeMinimum_x64.log
              • Size 4KB
              • SHA256 8ca9b18f36f4af696729f39187e8b16520caa38bf9466267fdf6b034084ade8d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dd_vcredist_amd64_20260820053927_001_vcRuntimeAdditional_x64.log
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260820053927_001_vcRuntimeAdditional_x64.log
              • Size 2KB
              • SHA256 91205012b3f2bfa289c9929ff90bc83e47d89af35fc7bf8939f9731b050a1ad9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ProtonVPN_v5.1.7_x64.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\is-VNXH6LJFGC.tmp\ProtonVPN_v5.1.7_x64.tmp
              • Size 3.8MB
              • SHA256 66952413b8db14e063825c461b1cb8036e2ef123e094ced762e6b89c9626bf7d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ProtonVPN.InstallActions.x86.dll
              • Path C:\Users\Admin\AppData\Local\Temp\is-VYYIWP3CC1.tmp\ProtonVPN.InstallActions.x86.dll
              • Size 460KB
              • SHA256 bd51e20ef2ca443d772e1b9bad20615a90ef2d89be95c8f78d072f903872870c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\is-VYYIWP3CC1.tmp\VC_redist.x64.exe
              • Size 17.9MB
              • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              logo.png
              • Path C:\Windows\Temp\{2C582C9C-14DD-4CB6-BB17-AEFC6DD0194C}\.ba\logo.png
              • Size 1KB
              • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{2C582C9C-14DD-4CB6-BB17-AEFC6DD0194C}\.ba\wixstdba.dll
              • Size 215KB
              • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Path C:\Windows\Temp\{2C582C9C-14DD-4CB6-BB17-AEFC6DD0194C}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
              • Size 5.4MB
              • SHA256 19c0cdc59ae89d0491c025a966f6d40515adc2449af40f2c6c6f52e2f293ad1c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cab5046A8AB272BF37297BB7928664C9503
              • Path C:\Windows\Temp\{2C582C9C-14DD-4CB6-BB17-AEFC6DD0194C}\cab5046A8AB272BF37297BB7928664C9503
              • Size 1.0MB
              • SHA256 6e8ee73933678c55973e83366e48e948b394c7a36743a36b7224c95de979b13f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeAdditional_x64
              • Path C:\Windows\Temp\{2C582C9C-14DD-4CB6-BB17-AEFC6DD0194C}\vcRuntimeAdditional_x64
              • Size 208KB
              • SHA256 476427800c1c958dc4e71d9a0f2f3983b2608da70835db9ee5f3b8ac387e9617
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcRuntimeMinimum_x64
              • Path C:\Windows\Temp\{2C582C9C-14DD-4CB6-BB17-AEFC6DD0194C}\vcRuntimeMinimum_x64
              • Size 208KB
              • SHA256 bab5d0257e6a18a4a008e683442e3077b38172dd61af3cb1c588b46724a714e2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VC_redist.x64.exe
              • Path C:\Windows\Temp\{A8F2A9EC-74A4-4E2E-AF41-FB1E27D8E15F}\.cr\VC_redist.x64.exe
              • Size 615KB
              • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wixstdba.dll
              • Path C:\Windows\Temp\{C9B0D7CA-2CEE-4A47-BE05-7BABAB0F2CB3}\.ba\wixstdba.dll
              • Size 191KB
              • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1068-2649-0x0000000000C90000-0x0000000000D07000-memory.dmp
              Download

              memory/1920-2647-0x0000000000C90000-0x0000000000D07000-memory.dmp
              Download

              memory/2228-1-0x0000000000970000-0x0000000000A95000-memory.dmp
              Download

              memory/2228-18-0x0000000000970000-0x0000000000A95000-memory.dmp
              Download

              memory/2228-2662-0x0000000000970000-0x0000000000A95000-memory.dmp
              Download

              memory/2388-2731-0x0000025E8FA20000-0x0000025E8FEFC000-memory.dmp
              Download

              memory/2388-2685-0x00007FFCA61F0000-0x00007FFCA6200000-memory.dmp
              Download

              memory/2596-2650-0x0000000000C90000-0x0000000000D07000-memory.dmp
              Download

              memory/4052-2730-0x000001E6365C0000-0x000001E636A9C000-memory.dmp
              Download

              memory/4480-2732-0x000001FF6AD70000-0x000001FF6B24C000-memory.dmp
              Download

              memory/4580-2661-0x0000000000780000-0x0000000000B61000-memory.dmp
              Download

              memory/4580-20-0x0000000002F50000-0x0000000002F51000-memory.dmp
              Download

              memory/4580-11-0x0000000003930000-0x0000000003A70000-memory.dmp
              Download

              memory/4580-19-0x0000000000780000-0x0000000000B61000-memory.dmp
              Download

              memory/4580-5-0x0000000002F50000-0x0000000002F51000-memory.dmp
              Download

              memory/4580-22-0x0000000000780000-0x0000000000B61000-memory.dmp
              Download

              memory/4580-23-0x0000000003930000-0x0000000003A70000-memory.dmp
              Download

              memory/4580-970-0x0000000000780000-0x0000000000B61000-memory.dmp
              Download

              memory/4580-1518-0x0000000003930000-0x0000000003A70000-memory.dmp
              Download

              memory/4580-2493-0x0000000000780000-0x0000000000B61000-memory.dmp
              Download