Overview

overview

10

Static

static

1

ProtonVPN_...64.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    93s
  • max time network
    171s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 07:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProtonVPN_v5.1.5_x64.exe
  • Size 122.8MB
  • Sample260822-jer6bssdme
  • SHA256 1e6600e45c0684d0faa7f040208603b72a0f7b1468b682c1007a31972cba1d9c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 51 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 44 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:3540
      • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.5_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.5_x64.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2544
        • C:\Users\Admin\AppData\Local\Temp\is-P0KB8RTPZP.tmp\ProtonVPN_v5.1.5_x64.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-P0KB8RTPZP.tmp\ProtonVPN_v5.1.5_x64.tmp" /SL5="$4018E,127461257,1139200,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.5_x64.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5996
          • C:\Users\Admin\AppData\Local\Temp\is-LOXZPMRMYA.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-LOXZPMRMYA.tmp\VC_redist.x64.exe" /install /quiet /norestart
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3196
            • C:\Windows\Temp\{F143EC1D-18AC-463C-8560-E34E752D5491}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{F143EC1D-18AC-463C-8560-E34E752D5491}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-LOXZPMRMYA.tmp\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5624
              • C:\Windows\Temp\{E062782C-AD77-4A5C-A10E-BC4369A8BCF2}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{E062782C-AD77-4A5C-A10E-BC4369A8BCF2}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7318050C-FB5D-4511-BCED-12129583E1D7} {35226183-6151-401B-A285-5462F93A1136} 5624
                6⤵
                • Adds Run key to start application
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:3908
          • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
            "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4200
            • C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.Client.exe
              "v5.1.5\ProtonVPN.Client.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
              5⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies Control Panel
              • Modifies registry class
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4692
      • C:\Program Files\Proton\VPN\v5.1.5\ProtonInstaller.exe
        C:\Program Files\Proton\VPN\v5.1.5\ProtonInstaller.exe /Mail /Drive /Pass /CreateDesktopShortcut
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.5.exe
          "C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.5.exe" Source=vpn /quiet NoAppDataCleanup=1 NoAutoLaunch=1
          3⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:588
          • C:\Windows\TEMP\{AD1F0B6D-3A88-4173-AB27-53F8A5703728}\.ba\wixprqba.exe
            "C:\Windows\TEMP\{AD1F0B6D-3A88-4173-AB27-53F8A5703728}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{4B237084-F47C-42F2-8594-1D5F14A71166} {87E61AF1-1BB3-44A8-9752-ADC355EA417F}
            4⤵
            • Executes dropped EXE
            PID:2328
          • C:\Windows\TEMP\{AD1F0B6D-3A88-4173-AB27-53F8A5703728}\.ba\wixiuiba.exe
            "C:\Windows\TEMP\{AD1F0B6D-3A88-4173-AB27-53F8A5703728}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{25EF9F6F-9F81-4012-8687-1CCFC0BB54EE} {92C52F8B-6359-42B6-8B16-189F083B9F67}
            4⤵
            • Executes dropped EXE
            PID:1924
        • C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe" --source=vpn --silent=1 --auto-launch=0
          3⤵
            PID:6064
            • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
              "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --source=vpn --silent=1 --auto-launch=0
              4⤵
                PID:6548
                • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Squirrel.exe
                  "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                  5⤵
                    PID:5768
                  • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe
                    "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe" --squirrel-install 1.13.4 --source="vpn" --desktop-shortcut=1
                    5⤵
                      PID:3208
                      • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe
                        "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Proton Mail" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Proton Mail\Crashpad" --url=https://mail-api.proton.me/core/v4/reports/sentry/api/54/minidump/?sentry_key=8c45c7615ac54aed9a6747430e0a5d8e "--annotation=_productName=Proton Mail" --annotation=_version=1.13.4 --annotation=plat=Win64 --annotation=prod=Electron "--annotation=sentry___initialScope={\"release\":\"[email protected]+packaged\",\"environment\":\"proton.me\"}" --annotation=ver=40.10.1 --initial-client-data=0x490,0x49c,0x4a0,0x494,0x4a4,0x7ff6409f5a0c,0x7ff6409f5a18,0x7ff6409f5a28
                        6⤵
                          PID:4876
                        • C:\Users\Admin\AppData\Local\proton_mail\Update.exe
                          C:\Users\Admin\AppData\Local\proton_mail\Update.exe "--createShortcut=Proton Mail.exe" --shortcut-locations=Desktop,StartMenu
                          6⤵
                            PID:3996
                          • C:\Windows\System32\reg.exe
                            C:\Windows\System32\reg.exe import C:\Users\Admin\AppData\Local\Temp\protonmail-mailto-register.reg
                            6⤵
                              PID:3976
                            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe
                              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2128,i,6330725224354728006,1596162537796167314,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2160 /prefetch:11
                              6⤵
                                PID:6172
                              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe
                                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2128,i,6330725224354728006,1596162537796167314,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2124 /prefetch:2
                                6⤵
                                  PID:6208
                      • C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.exe
                        "C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.exe"
                        1⤵
                        • Executes dropped EXE
                        PID:3116
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4880
                      • C:\Windows\system32\srtasks.exe
                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                        1⤵
                          PID:2388
                        • C:\Windows\system32\msiexec.exe
                          C:\Windows\system32\msiexec.exe /V
                          1⤵
                          • Enumerates connected drives
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:4708
                          • C:\Windows\System32\MsiExec.exe
                            C:\Windows\System32\MsiExec.exe -Embedding 3374A2E7A545DBC734A055FAA1F5FC08
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:4648
                            • C:\Windows\system32\rundll32.exe
                              rundll32.exe "C:\Windows\Installer\MSIF43.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240848796 6 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
                              3⤵
                              • Drops file in Windows directory
                              PID:3472
                            • C:\Windows\system32\rundll32.exe
                              rundll32.exe "C:\Windows\Installer\MSI108C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240849046 10 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
                              3⤵
                              • Drops file in Windows directory
                              PID:4512
                            • C:\Windows\system32\rundll32.exe
                              rundll32.exe "C:\Windows\Installer\MSI1158.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240849265 15 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.DoPerMachineUpgradeSupportActions
                              3⤵
                              • Drops file in Windows directory
                              PID:4380
                          • C:\Windows\System32\MsiExec.exe
                            C:\Windows\System32\MsiExec.exe -Embedding 21060902849C8806488D969B5DB53CC2
                            2⤵
                              PID:2324
                              • C:\Windows\system32\rundll32.exe
                                rundll32.exe "C:\Windows\Installer\MSI2E9A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240856781 40 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
                                3⤵
                                  PID:1800
                                • C:\Windows\system32\rundll32.exe
                                  rundll32.exe "C:\Windows\Installer\MSI535A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240866187 44 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
                                  3⤵
                                    PID:5556
                                  • C:\Windows\system32\rundll32.exe
                                    rundll32.exe "C:\Windows\Installer\MSI564C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240867109 66 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.RemoveStartupEntry
                                    3⤵
                                      PID:4352
                                • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                                  "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /burn.runonce
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4212
                                  • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                                    "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260822083642.log" /install
                                    2⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:4600
                                    • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                                      "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260822083642.log" /install
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:5372
                                      • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                                        "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{2DA28C05-E369-4540-9F58-987A19C6D628} {E7FF2533-492F-4AC8-9E40-23741528B284} 5372
                                        4⤵
                                        • Adds Run key to start application
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:2476
                                        • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                          "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{06CDC321-8771-4943-B5B3-489DC3520EFE} {C2D9B0CE-A80A-474A-8B76-DDAF8C197311} 2476
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:6120
                                          • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                            "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{06CDC321-8771-4943-B5B3-489DC3520EFE} {C2D9B0CE-A80A-474A-8B76-DDAF8C197311} 2476
                                            6⤵
                                            • Loads dropped DLL
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:1228
                                            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                                              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{773439E8-3785-4C90-87FC-27DAA7F0965D} {7340762D-1B36-4DF1-89C5-26A61454F2F4} 1228
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              PID:3772
                                • C:\Users\Admin\AppData\Local\Package Cache\{1D6B18D8-9229-4AB1-879D-185E4C7B3FA9}\Proton Drive Setup 3.0.5 (a5ffcb94) (x64).exe
                                  "C:\Users\Admin\AppData\Local\Package Cache\{1D6B18D8-9229-4AB1-879D-185E4C7B3FA9}\Proton Drive Setup 3.0.5 (a5ffcb94) (x64).exe" /burn.runonce
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:2300
                                  • C:\Users\Admin\AppData\Local\Package Cache\{1D6B18D8-9229-4AB1-879D-185E4C7B3FA9}\Proton Drive Setup 3.0.5 (a5ffcb94) (x64).exe
                                    "C:\Users\Admin\AppData\Local\Package Cache\{1D6B18D8-9229-4AB1-879D-185E4C7B3FA9}\Proton Drive Setup 3.0.5 (a5ffcb94) (x64).exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260822083723.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260822083723.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:5020
                                    • C:\Windows\TEMP\{56D579CC-8314-4B8C-A5C9-8ACFC42D1F84}\.ba\wixprqba.exe
                                      "C:\Windows\TEMP\{56D579CC-8314-4B8C-A5C9-8ACFC42D1F84}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{C258478E-CCFD-483F-843A-2E2AF3C24B3E} {2BF798AF-9623-4C12-AE9C-BE414EE93BF4}
                                      3⤵
                                      • Executes dropped EXE
                                      PID:5192
                                    • C:\Windows\TEMP\{56D579CC-8314-4B8C-A5C9-8ACFC42D1F84}\.ba\wixiuiba.exe
                                      "C:\Windows\TEMP\{56D579CC-8314-4B8C-A5C9-8ACFC42D1F84}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9F646AAE-F602-43A8-9BAF-A0CB5F180E92} {223826FD-CF6A-4FC3-9180-1229D3FFB69E}
                                      3⤵
                                        PID:4948
                                  • C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.exe
                                    "C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    PID:2448
                                    • C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.NrptWatchdog.exe
                                      "C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.NrptWatchdog.exe" --pid 2448
                                      2⤵
                                        PID:4264
                                      • C:\Program Files\Proton\VPN\v5.1.5\ServiceData\Updates\ProtonVPN_v5.1.7_x64.exe
                                        "C:\Program Files\Proton\VPN\v5.1.5\ServiceData\Updates\ProtonVPN_v5.1.7_x64.exe" /VERYSILENT /SUPPRESSMSGBOXES
                                        2⤵
                                          PID:2264
                                          • C:\Windows\SystemTemp\is-JLKR6VKLTA.tmp\ProtonVPN_v5.1.7_x64.tmp
                                            "C:\Windows\SystemTemp\is-JLKR6VKLTA.tmp\ProtonVPN_v5.1.7_x64.tmp" /SL5="$C0024,128731564,1139200,C:\Program Files\Proton\VPN\v5.1.5\ServiceData\Updates\ProtonVPN_v5.1.7_x64.exe" /VERYSILENT /SUPPRESSMSGBOXES
                                            3⤵
                                              PID:1440
                                              • C:\Windows\SystemTemp\is-OD1UYVAOUQ.tmp\VC_redist.x64.exe
                                                "C:\Windows\SystemTemp\is-OD1UYVAOUQ.tmp\VC_redist.x64.exe" /install /quiet /norestart
                                                4⤵
                                                  PID:7048
                                                  • C:\Windows\Temp\{BDEE39FE-7E37-49F9-86A2-B77C7F005D02}\.cr\VC_redist.x64.exe
                                                    "C:\Windows\Temp\{BDEE39FE-7E37-49F9-86A2-B77C7F005D02}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Windows\SystemTemp\is-OD1UYVAOUQ.tmp\VC_redist.x64.exe" -burn.filehandle.attached=756 -burn.filehandle.self=760 /install /quiet /norestart
                                                    5⤵
                                                      PID:7080
                                                      • C:\Windows\Temp\{C8E5D781-CE1C-437A-BA36-2A578016CF04}\.be\VC_redist.x64.exe
                                                        "C:\Windows\Temp\{C8E5D781-CE1C-437A-BA36-2A578016CF04}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{76AE59B1-DB43-4B30-A516-4D5CC199E430} {EC148EAC-9B31-44BE-A0A6-B68015F15E20} 7080
                                                        6⤵
                                                          PID:3716
                                              • C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.NrptWatchdog.exe
                                                "C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.NrptWatchdog.exe"
                                                1⤵
                                                  PID:4440
                                                • C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe
                                                  "C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe" -quiet
                                                  1⤵
                                                    PID:5908
                                                  • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                    "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /burn.runonce
                                                    1⤵
                                                      PID:4892
                                                      • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                        "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Windows\TEMP\dd_vcredist_amd64_20260822083814.log" /install
                                                        2⤵
                                                          PID:3772
                                                          • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                            "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Windows\TEMP\dd_vcredist_amd64_20260822083814.log" /install
                                                            3⤵
                                                              PID:3336
                                                              • C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe
                                                                "C:\ProgramData\Package Cache\{0e3bb569-69d6-4c34-bff9-c2f81db5e5f0}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{91FC6D72-C7F2-4B5F-A84C-46D8485F5EA6} {7FF57C04-28FF-4239-A704-EE966C3277B0} 3336
                                                                4⤵
                                                                  PID:1732
                                                                  • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                                                                    "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{7AE4AD5C-4312-464B-8EBF-E5C5D00116C5} {84F9A8D9-23CD-4E17-8AB4-1DBC58ABE3DF} 1732
                                                                    5⤵
                                                                      PID:1348
                                                                      • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                                                                        "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 -uninstall -quiet -burn.related.upgrade -burn.ancestors={0e3bb569-69d6-4c34-bff9-c2f81db5e5f0} -burn.filehandle.self=1008 -burn.embedded BurnPipe.{7AE4AD5C-4312-464B-8EBF-E5C5D00116C5} {84F9A8D9-23CD-4E17-8AB4-1DBC58ABE3DF} 1732
                                                                        6⤵
                                                                          PID:2248
                                                                          • C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe
                                                                            "C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{91D4FC8D-4EF4-43E0-90CC-10B4EE5D8784} {CEC3CDC4-EDA9-4B32-8E92-86D121D3D57E} 2248
                                                                            7⤵
                                                                              PID:4528

                                                                Network

                                                                      MITRE ATT&CK Enterprise v16

                                                                      Replay Monitor

                                                                      Loading Replay Monitor...

                                                                      Downloads

                                                                      e5a9745.rbs
                                                                      • Path C:\Config.Msi\e5a9745.rbs
                                                                      • Size 19KB
                                                                      • SHA256 b7a7093bd53b2e1cfeb189e8bce459a9a6bf3266e888ac479c881f77c5522594
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a9751.rbs
                                                                      • Path C:\Config.Msi\e5a9751.rbs
                                                                      • Size 19KB
                                                                      • SHA256 e2d6bc593aa2d0b243acd3bac6a69b8898e553949c8a33702fc8651ee29acb6e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a9758.rbs
                                                                      • Path C:\Config.Msi\e5a9758.rbs
                                                                      • Size 21KB
                                                                      • SHA256 ac5a23fd0f94179ece83592ea8ddaf63e54571f27f155da1604fcfbd89730e95
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a9767.rbs
                                                                      • Path C:\Config.Msi\e5a9767.rbs
                                                                      • Size 21KB
                                                                      • SHA256 727781c8811559b78ae64304c718663f49bb09565f98c624612157b6b8626a96
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a976c.rbs
                                                                      • Path C:\Config.Msi\e5a976c.rbs
                                                                      • Size 21KB
                                                                      • SHA256 d8385d5199f807df99d4c8b18d1d958be080b44921ec209c1614613c20ece268
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a9770.rbs
                                                                      • Path C:\Config.Msi\e5a9770.rbs
                                                                      • Size 3KB
                                                                      • SHA256 d8d49dda60bd9e8e3142ea9d16d0dc282f7c2be76b9f18bb15bce6beccbc3ba4
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      e5a9776.rbs
                                                                      • Path C:\Config.Msi\e5a9776.rbs
                                                                      • Size 20KB
                                                                      • SHA256 cd0f30f48da96ceab5431e8af9728c402d2d292a0efa8587d6b3c2f9b8346e96
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a9783.rbs
                                                                      • Path C:\Config.Msi\e5a9783.rbs
                                                                      • Size 19KB
                                                                      • SHA256 ac591f1e1faaedea20537aa64133f8c4145d81ff9bd08fde24330104730b6d07
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a978a.rbs
                                                                      • Path C:\Config.Msi\e5a978a.rbs
                                                                      • Size 21KB
                                                                      • SHA256 f7111664f99dd443954b9c22f3dc0bde2451b9af2189b7b4501715a97e48ff52
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      e5a9799.rbs
                                                                      • Path C:\Config.Msi\e5a9799.rbs
                                                                      • Size 21KB
                                                                      • SHA256 9e7499882cdf332bf32a2681f26625b88241a7cc768e3c1fa091531f41c5b0e5
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPN.Launcher.exe
                                                                      • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
                                                                      • Size 17.9MB
                                                                      • SHA256 bf83f90b2994d8f086459f80bba0c78281bd44130c3af4ea6ddc812268fb3d4f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPN.Launcher.exe
                                                                      • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
                                                                      • Size 17.9MB
                                                                      • SHA256 c2795771df5f5eb60b8d77877a7f04d973137aed52ba474b2adb0a966400431d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      unins000.exe
                                                                      • Path C:\Program Files\Proton\VPN\unins000.exe
                                                                      • Size 3.8MB
                                                                      • SHA256 66952413b8db14e063825c461b1cb8036e2ef123e094ced762e6b89c9626bf7d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Microsoft.WinUI.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\Microsoft.WinUI.dll
                                                                      • Size 7.0MB
                                                                      • SHA256 b745cc38595f48f6b33c02eefc5d5df15a7759ea9e918ce1c18ddf3eb050ce38
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Microsoft.WindowsAppRuntime.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\Microsoft.WindowsAppRuntime.dll
                                                                      • Size 2.2MB
                                                                      • SHA256 8d593c4374b193b18ba37b8be8cce093ae4f247423c127ee9c09a63ded3dbb64
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonInstaller.exe
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonInstaller.exe
                                                                      • Size 6.0MB
                                                                      • SHA256 0e0ca31d330f3e428dbb82605357fafeef75e6f3442067449761f5f71d2a1179
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPN.Client.deps.json
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.Client.deps.json
                                                                      • Size 566KB
                                                                      • SHA256 d9cdf7762431278a8a3f3cb9febb30deecc0da5b075f9c8e89628fada9879fc1
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPN.Client.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.Client.dll
                                                                      • Size 3.0MB
                                                                      • SHA256 96d695ee578317a594fbb240b6ffb86cb005bc4a7d2eccdbb0f27eaa14760b3f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPN.Client.exe
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.Client.exe
                                                                      • Size 590KB
                                                                      • SHA256 5f72dd314eebec51d0271259e1388bce7365f22fed450ae27efdeaf1716ecda5
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPN.Common.Core.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPN.Common.Core.dll
                                                                      • Size 72KB
                                                                      • SHA256 bfc8b92cff28777b47580f131959d4a1df4140ae820d5d6b93963b79f61f5e3f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPNService.deps.json
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.deps.json
                                                                      • Size 390KB
                                                                      • SHA256 42c99f247433c80cd44cbfac1889547d93f01d5a8d960bb57f95768b2a13587d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPNService.exe
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.exe
                                                                      • Size 466KB
                                                                      • SHA256 153699e8ba64fdc1763b39aa5c877dbe227c7e5b250811b8c39e7ea671051e7f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPNService.runtimeconfig.json
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\ProtonVPNService.runtimeconfig.json
                                                                      • Size 629B
                                                                      • SHA256 becb5e7dbe360a21ec893d5fbed565339094204adeb595a83cb2541e0fc99cb9
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      Sentry.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\Sentry.dll
                                                                      • Size 787KB
                                                                      • SHA256 15011a9f08363a311e141b2768cd39e04a49486a2477e3d4274f588f94c86823
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      System.Collections.Concurrent.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\System.Collections.Concurrent.dll
                                                                      • Size 269KB
                                                                      • SHA256 0b1545071db0e5e918035aa7103bf8864d504099c6083bed5db94f8657711d74
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      System.Collections.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\System.Collections.dll
                                                                      • Size 253KB
                                                                      • SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      System.Linq.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\System.Linq.dll
                                                                      • Size 529KB
                                                                      • SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      System.Private.CoreLib.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\System.Private.CoreLib.dll
                                                                      • Size 12.6MB
                                                                      • SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      System.Runtime.InteropServices.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\System.Runtime.InteropServices.dll
                                                                      • Size 93KB
                                                                      • SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      System.Runtime.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\System.Runtime.dll
                                                                      • Size 42KB
                                                                      • SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      System.Threading.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\System.Threading.dll
                                                                      • Size 81KB
                                                                      • SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      WinRT.Runtime.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\WinRT.Runtime.dll
                                                                      • Size 516KB
                                                                      • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      clrjit.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\clrjit.dll
                                                                      • Size 1.7MB
                                                                      • SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      coreclr.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\coreclr.dll
                                                                      • Size 4.8MB
                                                                      • SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      hostfxr.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\hostfxr.dll
                                                                      • Size 357KB
                                                                      • SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      hostpolicy.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\hostpolicy.dll
                                                                      • Size 397KB
                                                                      • SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      is-PRXPC3Z4EM.tmp
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.5\is-PRXPC3Z4EM.tmp
                                                                      • Size 245KB
                                                                      • SHA256 60f195a13bf0e240ca9615cb98cdfd25f0875905b839ff2b796c9cadba0ff8af
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPN.InstallActions.x86.dll
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.7\Resources\ProtonVPN.InstallActions.x86.dll
                                                                      • Size 460KB
                                                                      • SHA256 bd51e20ef2ca443d772e1b9bad20615a90ef2d89be95c8f78d072f903872870c
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      is-5W8LDOWJ0O.tmp
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.7\is-5W8LDOWJ0O.tmp
                                                                      • Size 237KB
                                                                      • SHA256 1d99a14ae2322bf36f9fe6553df0c20911c9d11e9d4d849778f311e031b8427d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      is-5X13O74GKW.tmp
                                                                      • Path C:\Program Files\Proton\VPN\v5.1.7\is-5X13O74GKW.tmp
                                                                      • Size 368KB
                                                                      • SHA256 59e4139e760853d26ac3cd777fe88f76d3df141fa187c77c62493835e888b5a0
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      state.rsm
                                                                      • Path C:\ProgramData\Package Cache\{91ee571b-0e8a-4c65-9eaf-2e2f5fc60c00}\state.rsm
                                                                      • Size 980B
                                                                      • SHA256 7e3368641e430ec9147962bed5a7691775211be8ba67f039e8c9f3421f77921f
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      dd_vcredist_amd64_20260822083642_000_vcRuntimeMinimum_x64.log
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260822083642_000_vcRuntimeMinimum_x64.log
                                                                      • Size 2KB
                                                                      • SHA256 c9151fcf07b2d446dc91f1f8097a13613bb56ba2397bff9c9a3de832c0c22b30
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      dd_vcredist_amd64_20260822083642_001_vcRuntimeAdditional_x64.log
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260822083642_001_vcRuntimeAdditional_x64.log
                                                                      • Size 2KB
                                                                      • SHA256 8a5250ee5e1bcc151f4ec2ce68fb5d4b7c1c2c35b9e9fd442e00c945da9e049b
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      ProtonVPN.InstallActions.x86.dll
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-LOXZPMRMYA.tmp\ProtonVPN.InstallActions.x86.dll
                                                                      • Size 460KB
                                                                      • SHA256 fb1eddad17872e203e5e1a2753f5ce94e6dc67748b11634cd2f83c1fe191d86e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      VC_redist.x64.exe
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-LOXZPMRMYA.tmp\VC_redist.x64.exe
                                                                      • Size 17.7MB
                                                                      • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      ProtonVPN_v5.1.5_x64.tmp
                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-P0KB8RTPZP.tmp\ProtonVPN_v5.1.5_x64.tmp
                                                                      • Size 3.8MB
                                                                      • SHA256 732f673f6ae635d9734b8a48915ed98bb6f9ae0f2d1be6c9d8a1365a886e6b8f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      squirrel.exe
                                                                      • Path C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\squirrel.exe
                                                                      • Size 2.1MB
                                                                      • SHA256 1a546fad8c79db03eea7f9bf5bb4c73dfb1f391303547be3917014a220b3ed82
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Proton Drive.lnk
                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk
                                                                      • Size 1KB
                                                                      • SHA256 20ba5d6667efad7a8a4d6737e3ff64aa83b239ddda29864fabcae5cd040e9f3f
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      Proton Drive.lnk~RFe5b298d.TMP
                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk~RFe5b298d.TMP
                                                                      • Size 1KB
                                                                      • SHA256 0fced53d782ed531642f80bb246912e71ad8742e3cc75fb05c8c26cd5b1c761b
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      temp-index
                                                                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\Code Cache\js\index-dir\temp-index
                                                                      • Size 48B
                                                                      • SHA256 b6ae7ee61e22e63250951600b4bc4210d60924a54dc3e8c8a959b4437f58ba1b
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      index
                                                                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\Code Cache\wasm\index
                                                                      • Size 24B
                                                                      • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      CURRENT
                                                                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\Local Storage\leveldb\CURRENT
                                                                      • Size 16B
                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      MANIFEST-000001
                                                                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\Local Storage\leveldb\MANIFEST-000001
                                                                      • Size 41B
                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      the-real-index
                                                                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\Shared Dictionary\cache\index-dir\the-real-index
                                                                      • Size 48B
                                                                      • SHA256 3f3f70d097767ce0a346878cef132abcfc0b458b1f3c8023ac9d4eded17bdc31
                                                                      • MD5 SHA1 SHA512
                                                                      Submit Download

                                                                      config.json
                                                                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
                                                                      • Size 216B
                                                                      • SHA256 7d42c78f93792c2a94213a624de1d5b73acf0cba4417b239df8d2041ed4b98e7
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      config.json
                                                                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
                                                                      • Size 395B
                                                                      • SHA256 5bd0da910d64c8898383ab3bf102732cd2c864d891efd9194c8e4362d6f5d346
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      config.json.tmp-73843210227715de
                                                                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json.tmp-73843210227715de
                                                                      • Size 456B
                                                                      • SHA256 af4bdf4dd43d81b29478c9230f57bdda54bc44ce633fa95e943e8755b3831130
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      main.log
                                                                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
                                                                      • Size 2KB
                                                                      • SHA256 c916c6701f7d61d57b7d2f6d5fbd2af4c1d325aa01af79a9947946c23e34a4de
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      main.log
                                                                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
                                                                      • Size 4KB
                                                                      • SHA256 ce6ccc701aad5f645e9e019d3891605e9dc25861643665d44d415a5d67bab40e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      Proton Drive.lnk
                                                                      • Path C:\Users\Admin\Desktop\Proton Drive.lnk
                                                                      • Size 1KB
                                                                      • SHA256 6566a2e3270c4f291e72340f7af8ba19f879b554023a8add94e853c8ef10208e
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      Proton Drive.lnk~RFe5b2a97.TMP
                                                                      • Path C:\Users\Admin\Desktop\Proton Drive.lnk~RFe5b2a97.TMP
                                                                      • Size 1KB
                                                                      • SHA256 dcb5a7a02289bf6c84b31d9522051b0c3b14bd4a3522abe737b78533ab73589b
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      MSI1158.tmp
                                                                      • Path C:\Windows\Installer\MSI1158.tmp
                                                                      • Size 322KB
                                                                      • SHA256 2f5729362250c558f123db19982da618d30c3dc743e67e073385f17504d1d4de
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      MSI13DC.tmp
                                                                      • Path C:\Windows\Installer\MSI13DC.tmp
                                                                      • Size 390KB
                                                                      • SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      CustomAction.config
                                                                      • Path C:\Windows\Installer\SFXCA74005BF5054D46BA719BD06C2565CA3C\CustomAction.config
                                                                      • Size 959B
                                                                      • SHA256 7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      Proton.Drive.Installer.Extensions.dll
                                                                      • Path C:\Windows\Installer\SFXCA74005BF5054D46BA719BD06C2565CA3C\Proton.Drive.Installer.Extensions.dll
                                                                      • Size 7KB
                                                                      • SHA256 2836b86f93c3cae3989b53fdf0d96071e1bdea9efa2a9025860c9e565c7d5202
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      WixToolset.Dtf.WindowsInstaller.dll
                                                                      • Path C:\Windows\Installer\SFXCA74005BF5054D46BA719BD06C2565CA3C\WixToolset.Dtf.WindowsInstaller.dll
                                                                      • Size 193KB
                                                                      • SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      concrt140.dll
                                                                      • Path C:\Windows\System32\concrt140.dll
                                                                      • Size 314KB
                                                                      • SHA256 b2faf3b85b23c840b654e57d5497a0ad31acd02fb01856cad4725a1715d5f78e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140.dll
                                                                      • Path C:\Windows\System32\mfc140.dll
                                                                      • Size 5.4MB
                                                                      • SHA256 38529fbb294d03fa40d46490ad2a6d34bb3c3f0e433bd7a7d4595dc1dbc02da9
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140chs.dll
                                                                      • Path C:\Windows\System32\mfc140chs.dll
                                                                      • Size 50KB
                                                                      • SHA256 49af80716dafc68b794ab07be51c3014f0757fb2a9b18dd996c176127aab1582
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140cht.dll
                                                                      • Path C:\Windows\System32\mfc140cht.dll
                                                                      • Size 50KB
                                                                      • SHA256 0bda5231fc2d8de6ef747ef70dc24d431cacb623817907bf18cd4241eb61f6cc
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140deu.dll
                                                                      • Path C:\Windows\System32\mfc140deu.dll
                                                                      • Size 78KB
                                                                      • SHA256 12043e8f7dbc42595d21bda76df00c9740c40c69bdcbef1924233f6b0b1aa8aa
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140enu.dll
                                                                      • Path C:\Windows\System32\mfc140enu.dll
                                                                      • Size 68KB
                                                                      • SHA256 be6992601a40a80e3cc35859132bf81afda880da575b20d3e44bf69d338cd2c4
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140esn.dll
                                                                      • Path C:\Windows\System32\mfc140esn.dll
                                                                      • Size 77KB
                                                                      • SHA256 f6fc89f698a4cb21ca50da0ded143affca62644bbd5fa3bd2da9b38b4ddc0f87
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140fra.dll
                                                                      • Path C:\Windows\System32\mfc140fra.dll
                                                                      • Size 78KB
                                                                      • SHA256 2aab7f9beadfdb15cf700caa7b08741ba474eb8011363c0b8d6f96deb5879325
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140ita.dll
                                                                      • Path C:\Windows\System32\mfc140ita.dll
                                                                      • Size 76KB
                                                                      • SHA256 72d4a6fdeaed0de9a8bfcdfa739ad46bf23bff9fc027625196b57bed5657ae1a
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140jpn.dll
                                                                      • Path C:\Windows\System32\mfc140jpn.dll
                                                                      • Size 57KB
                                                                      • SHA256 1ea3fb659cb8128d5e999f30e89a83b171054afb94668c73ed5a31b32caaed5b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140kor.dll
                                                                      • Path C:\Windows\System32\mfc140kor.dll
                                                                      • Size 57KB
                                                                      • SHA256 073796d40a3b23b1f7fb33b37512c2fa1fe7a5c6cfd20e50b027ecbf4fee6a40
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140rus.dll
                                                                      • Path C:\Windows\System32\mfc140rus.dll
                                                                      • Size 74KB
                                                                      • SHA256 5a2aa0f37a51701b82cc7ba7df1fb0fccc622dcb496006e450c86140cc965cb8
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfc140u.dll
                                                                      • Path C:\Windows\System32\mfc140u.dll
                                                                      • Size 5.4MB
                                                                      • SHA256 fc9b1f94752d7080436824b480e83ba1ec930e3f7baa881f4e842b882e715cfc
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfcm140.dll
                                                                      • Path C:\Windows\System32\mfcm140.dll
                                                                      • Size 93KB
                                                                      • SHA256 8a80ff43bd6eda6b2da48af3062032def77f49eba2179ee620defe08e85eacf7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      mfcm140u.dll
                                                                      • Path C:\Windows\System32\mfcm140u.dll
                                                                      • Size 93KB
                                                                      • SHA256 864848772fa5100f306ae5370ab6f7a0c1d66f3825b158b19bee04b1db9e5deb
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      msvcp140.dll
                                                                      • Path C:\Windows\System32\msvcp140.dll
                                                                      • Size 540KB
                                                                      • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      msvcp140_1.dll
                                                                      • Path C:\Windows\System32\msvcp140_1.dll
                                                                      • Size 34KB
                                                                      • SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      msvcp140_2.dll
                                                                      • Path C:\Windows\System32\msvcp140_2.dll
                                                                      • Size 272KB
                                                                      • SHA256 1d60da3ac2b06482912ca852fa7047436e6e474b4cfffa3bf77f4598cfbf454c
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      msvcp140_atomic_wait.dll
                                                                      • Path C:\Windows\System32\msvcp140_atomic_wait.dll
                                                                      • Size 47KB
                                                                      • SHA256 e7963645e0d1db08e300614d4c5fa7194bd8173e9ab7a5558859e6b232ed3241
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      msvcp140_codecvt_ids.dll
                                                                      • Path C:\Windows\System32\msvcp140_codecvt_ids.dll
                                                                      • Size 30KB
                                                                      • SHA256 ae8d922b00cdd93e3ebecc37beb46c800f383ebdeb9f9e5b84e04a72428b6fb3
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcamp140.dll
                                                                      • Path C:\Windows\System32\vcamp140.dll
                                                                      • Size 410KB
                                                                      • SHA256 617f6031929ec70a084a9dd1f01e037494a74d8c66703b7fb53e80547f90af28
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vccorlib140.dll
                                                                      • Path C:\Windows\System32\vccorlib140.dll
                                                                      • Size 342KB
                                                                      • SHA256 6b8d8a76c3e6664293407553650e60b94df9aaafc7c92057ea83032bd228e44f
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcomp140.dll
                                                                      • Path C:\Windows\System32\vcomp140.dll
                                                                      • Size 208KB
                                                                      • SHA256 31af29c03643f8396a6f26bcd601c6369d26493d7d78b714827ab2801bd284c7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcruntime140_1.dll
                                                                      • Path C:\Windows\System32\vcruntime140_1.dll
                                                                      • Size 46KB
                                                                      • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcruntime140_threads.dll
                                                                      • Path C:\Windows\System32\vcruntime140_threads.dll
                                                                      • Size 36KB
                                                                      • SHA256 a6222020b500a9a86b36e040c2dbd0e459716db1bf2810a11cd7512ea9b8d89b
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1028\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 c1fe572ca3dd4387e473272bc9f2a2da5dbee58fa8ad6010eb308e119c903da0
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1029\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 1aa579e8e2cb828c9bbbd598e837d6923262fc4c8fbc1ee30b166cfcb10a849c
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1031\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 4f3601c2c80999ca9a2ab7c42c1170220f1ff4d958d210d12e50168631c303ab
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1036\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 4127145ea3ccc42f9364fefa3eaf7f50e3229eb6ab2ebcdca33a0609003a69a5
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1040\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 5d3c97e5ac0b8bac06f6a0c6e3edd92ab5c2c8978543c770b826139edf624c24
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1041\thm.wxl
                                                                      • Size 4KB
                                                                      • SHA256 04ce070c6f65c85958cd1d5518327bcd615469910f02254dcbbd5f95eebb2212
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1042\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 cd825881d63ea021d6002eb8375d51a508fcb784fb90753e6323776a3e651aaa
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1045\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 49323aaa73e4dfa7dff2dfce004d89cc1d2d4f7d7d530f4cae0b67cf9f91c789
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1046\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 cc146b6e1788bff1d0363ca894229b13632b8546a76a55ea1a4cc2dbb4470aba
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1049\thm.wxl
                                                                      • Size 4KB
                                                                      • SHA256 8fa0e3b51a00c5559d1120b1c66b2a00c7693147257b2911fe038a7bf7b8fd94
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\1055\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 90085069fdf4dcd699579209dbfd62a6719fe1a6e07168b938b92913da3287a3
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\2052\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 62bdb8fa52dcf8b5298da5fc7a745aa9481eadb3f32862f2996d070c29f21d2c
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\3082\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 2c6f29f040da15f2b6a63cfbf47e07f569afdb778f178feec9e0079199644aca
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      BootstrapperApplicationData.xml
                                                                      • Path C:\Windows\Temp\{2015B7D7-0A9C-4745-A9BA-D66874FA5B50}\.ba\BootstrapperApplicationData.xml
                                                                      • Size 7KB
                                                                      • SHA256 1ce95b466c776490014e99096c7f96785147d99f5488fa8e297ad9bf60730493
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      thm.wxl
                                                                      • Path C:\Windows\Temp\{C8E5D781-CE1C-437A-BA36-2A578016CF04}\.ba\thm.wxl
                                                                      • Size 3KB
                                                                      • SHA256 21a76eb702fe727ca06de6632be2294ed1caa9e1d3798d01ed1428e0f40e19ea
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      thm.xml
                                                                      • Path C:\Windows\Temp\{C8E5D781-CE1C-437A-BA36-2A578016CF04}\.ba\thm.xml
                                                                      • Size 8KB
                                                                      • SHA256 8d67851408a62b0f04dbaaddc588cd98499cf3630ec5df9f7c0699f0d367f79c
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      VC_redist.x64.exe
                                                                      • Path C:\Windows\Temp\{C8E5D781-CE1C-437A-BA36-2A578016CF04}\.be\VC_redist.x64.exe
                                                                      • Size 615KB
                                                                      • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      logo.png
                                                                      • Path C:\Windows\Temp\{E062782C-AD77-4A5C-A10E-BC4369A8BCF2}\.ba\logo.png
                                                                      • Size 1KB
                                                                      • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                      • MD5 SHA1 SHA512 TLSH
                                                                      Submit Download

                                                                      wixstdba.dll
                                                                      • Path C:\Windows\Temp\{E062782C-AD77-4A5C-A10E-BC4369A8BCF2}\.ba\wixstdba.dll
                                                                      • Size 215KB
                                                                      • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                      • Path C:\Windows\Temp\{E062782C-AD77-4A5C-A10E-BC4369A8BCF2}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
                                                                      • Size 5.4MB
                                                                      • SHA256 62a859b0db8bca416c7b6ad2ad5d2c84a4890a39e5d45cbec75f90a2fd328749
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      cab5046A8AB272BF37297BB7928664C9503
                                                                      • Path C:\Windows\Temp\{E062782C-AD77-4A5C-A10E-BC4369A8BCF2}\cab5046A8AB272BF37297BB7928664C9503
                                                                      • Size 967KB
                                                                      • SHA256 c346d91193246b18301cce532f2ae784fb377cb068d77bd22edec238e5746aa7
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcRuntimeAdditional_x64
                                                                      • Path C:\Windows\Temp\{E062782C-AD77-4A5C-A10E-BC4369A8BCF2}\vcRuntimeAdditional_x64
                                                                      • Size 208KB
                                                                      • SHA256 275d770dc4332bf6f3eae9ebc544ed07e3b169de791ba3d20ad50f04d9d222df
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      vcRuntimeMinimum_x64
                                                                      • Path C:\Windows\Temp\{E062782C-AD77-4A5C-A10E-BC4369A8BCF2}\vcRuntimeMinimum_x64
                                                                      • Size 208KB
                                                                      • SHA256 57d65221ca418dabfcc6320215b2c05eec907690aa4f93384f2007eb9e1394b0
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      wixstdba.dll
                                                                      • Path C:\Windows\Temp\{E3130A97-E678-4472-80B9-FF780BF6E472}\.ba\wixstdba.dll
                                                                      • Size 191KB
                                                                      • SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      VC_redist.x64.exe
                                                                      • Path C:\Windows\Temp\{F143EC1D-18AC-463C-8560-E34E752D5491}\.cr\VC_redist.x64.exe
                                                                      • Size 615KB
                                                                      • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                      Submit Download

                                                                      memory/1228-2650-0x0000000000C80000-0x0000000000CF7000-memory.dmp
                                                                      Download

                                                                      memory/1348-6015-0x00000000006E0000-0x0000000000759000-memory.dmp
                                                                      Download

                                                                      memory/1440-2954-0x0000000002A50000-0x0000000002B90000-memory.dmp
                                                                      Download

                                                                      memory/1440-6055-0x0000000000EA0000-0x0000000001281000-memory.dmp
                                                                      Download

                                                                      memory/1440-5628-0x0000000000EA0000-0x0000000001281000-memory.dmp
                                                                      Download

                                                                      memory/1440-4544-0x0000000000EA0000-0x0000000001281000-memory.dmp
                                                                      Download

                                                                      memory/2248-6014-0x00000000006E0000-0x0000000000759000-memory.dmp
                                                                      Download

                                                                      memory/2264-6058-0x00000000003F0000-0x0000000000515000-memory.dmp
                                                                      Download

                                                                      memory/2264-4543-0x00000000003F0000-0x0000000000515000-memory.dmp
                                                                      Download

                                                                      memory/2264-2946-0x00000000003F0000-0x0000000000515000-memory.dmp
                                                                      Download

                                                                      memory/2448-5626-0x00007FFFB1A50000-0x00007FFFB1A6E000-memory.dmp
                                                                      Download

                                                                      memory/2544-23-0x0000000000CD0000-0x0000000000DF5000-memory.dmp
                                                                      Download

                                                                      memory/2544-2673-0x0000000000CD0000-0x0000000000DF5000-memory.dmp
                                                                      Download

                                                                      memory/2544-0-0x0000000000CD0000-0x0000000000DF5000-memory.dmp
                                                                      Download

                                                                      memory/3472-2757-0x000002036E8B0000-0x000002036E8B6000-memory.dmp
                                                                      Download

                                                                      memory/3472-2755-0x0000020370E60000-0x0000020370E94000-memory.dmp
                                                                      Download

                                                                      memory/3772-2648-0x0000000000C80000-0x0000000000CF7000-memory.dmp
                                                                      Download

                                                                      memory/3996-6424-0x0000000002BE0000-0x0000000002C00000-memory.dmp
                                                                      Download

                                                                      memory/4528-6012-0x00000000006E0000-0x0000000000759000-memory.dmp
                                                                      Download

                                                                      memory/4708-2889-0x000002A684EE0000-0x000002A685884000-memory.dmp
                                                                      Download

                                                                      memory/4708-2674-0x000002A684EE0000-0x000002A685884000-memory.dmp
                                                                      Download

                                                                      memory/4708-5625-0x000002A684EE0000-0x000002A685884000-memory.dmp
                                                                      Download

                                                                      memory/4708-6090-0x000002A684EE0000-0x000002A685884000-memory.dmp
                                                                      Download

                                                                      memory/5768-6084-0x0000000000320000-0x000000000053E000-memory.dmp
                                                                      Download

                                                                      memory/5996-1405-0x0000000000900000-0x0000000000CE1000-memory.dmp
                                                                      Download

                                                                      memory/5996-2492-0x0000000000900000-0x0000000000CE1000-memory.dmp
                                                                      Download

                                                                      memory/5996-2672-0x0000000000900000-0x0000000000CE1000-memory.dmp
                                                                      Download

                                                                      memory/5996-1155-0x00000000043A0000-0x00000000044E0000-memory.dmp
                                                                      Download

                                                                      memory/5996-84-0x0000000000900000-0x0000000000CE1000-memory.dmp
                                                                      Download

                                                                      memory/5996-24-0x00000000033F0000-0x00000000033F1000-memory.dmp
                                                                      Download

                                                                      memory/5996-19-0x00000000043A0000-0x00000000044E0000-memory.dmp
                                                                      Download

                                                                      memory/5996-12-0x00000000043A0000-0x00000000044E0000-memory.dmp
                                                                      Download

                                                                      memory/5996-6-0x00000000033F0000-0x00000000033F1000-memory.dmp
                                                                      Download

                                                                      memory/6120-2651-0x0000000000C80000-0x0000000000CF7000-memory.dmp
                                                                      Download

                                                                      memory/6548-5764-0x0000000000F10000-0x00000000010E8000-memory.dmp
                                                                      Download