Overview

overview

6

Static

static

1

planetvpn.exe

windows10-2004-x64

6

planetvpn.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    120s
  • max time network
    138s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 08:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    planetvpn.exe
  • Size 121.6MB
  • Sample260823-kclffaztdx
  • SHA256 8cff9a2180169ac311e8d8e9aac1e717dcfe34efb7fe9ade8f15260d2feb558f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutioninstallerpersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Drops file in System32 directory 9 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 18 IoCs
  • Loads dropped DLL 35 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 8 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 42 IoCs
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\planetvpn.exe
    "C:\Users\Admin\AppData\Local\Temp\planetvpn.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Users\Admin\AppData\Local\Temp\is-NQYY5YLI8H.tmp\planetvpn.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NQYY5YLI8H.tmp\planetvpn.tmp" /SL5="$40116,125997505,1161728,C:\Users\Admin\AppData\Local\Temp\planetvpn.exe"
      2⤵
      • Adds Run key to start application
      • Checks for any installed AV software in registry
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4828
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" firebase --measurement-id "G-V91HQN6VVL" --api-secret "v0P2tywaT_-LmY8DSfzVIw" --client-id "beb336f80c02002e55f1d81c38dfc70d0f7282c1cad8bdf3b0508b024e1a5cdb" --event "installer_partner_offer_shown" --timeout-ms 5000 --param-number "engagement_time_msec=1" --param-number "session_id=20260823092826" --param "offer_surface=installer_banner" --param "platform=windows" --param "distribution_channel=CDN" --param "app_version=2.10.106.118" --param "build_date=2026-08-18" --param "commit_hash=" --param "os_name=windows" --param "os_version=10.0.26100" --param "offer_language=en" --param "offer_id=opera_browser" --param "partner_name=opera" --param "utm_source=Installer" --param "utm_medium=pb" --param "utm_campaign=bundle"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5536
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" firebase --measurement-id "G-V91HQN6VVL" --api-secret "v0P2tywaT_-LmY8DSfzVIw" --client-id "beb336f80c02002e55f1d81c38dfc70d0f7282c1cad8bdf3b0508b024e1a5cdb" --event "installer_partner_offer_accepted" --timeout-ms 5000 --param-number "engagement_time_msec=1" --param-number "session_id=20260823092826" --param "offer_surface=installer_banner" --param "platform=windows" --param "distribution_channel=CDN" --param "app_version=2.10.106.118" --param "build_date=2026-08-18" --param "commit_hash=" --param "os_name=windows" --param "os_version=10.0.26100" --param "offer_language=en" --param "offer_id=opera_browser" --param "partner_name=opera" --param "utm_source=Installer" --param "utm_medium=pb" --param "utm_campaign=bundle"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3532
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" firebase --measurement-id "G-V91HQN6VVL" --api-secret "v0P2tywaT_-LmY8DSfzVIw" --client-id "beb336f80c02002e55f1d81c38dfc70d0f7282c1cad8bdf3b0508b024e1a5cdb" --event "installer_partner_offer_shown" --timeout-ms 5000 --param-number "engagement_time_msec=1" --param-number "session_id=20260823092826" --param "offer_surface=installer_banner" --param "platform=windows" --param "distribution_channel=CDN" --param "app_version=2.10.106.118" --param "build_date=2026-08-18" --param "commit_hash=" --param "os_name=windows" --param "os_version=10.0.26100" --param "offer_language=en" --param "offer_id=avast_antivirus" --param "partner_name=avast" --param "utm_source=Installer" --param "utm_medium=pb" --param "utm_campaign=bundle"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4972
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" firebase --measurement-id "G-V91HQN6VVL" --api-secret "v0P2tywaT_-LmY8DSfzVIw" --client-id "beb336f80c02002e55f1d81c38dfc70d0f7282c1cad8bdf3b0508b024e1a5cdb" --event "installer_partner_offer_accepted" --timeout-ms 5000 --param-number "engagement_time_msec=1" --param-number "session_id=20260823092826" --param "offer_surface=installer_banner" --param "platform=windows" --param "distribution_channel=CDN" --param "app_version=2.10.106.118" --param "build_date=2026-08-18" --param "commit_hash=" --param "os_name=windows" --param "os_version=10.0.26100" --param "offer_language=en" --param "offer_id=avast_antivirus" --param "partner_name=avast" --param "utm_source=Installer" --param "utm_medium=pb" --param "utm_campaign=bundle"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4808
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPN.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPN.exe" -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5016
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPN.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4892
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPN.exe" -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1248
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" service-stop --name "PlanetVPNService" --timeout-ms 133000
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Time Discovery
        PID:5612
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe" -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4072
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" service-state --name "PlanetVPNService"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3728
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe" -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4292
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1952
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe" -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2964
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNHelper.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4572
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNHelper.exe" -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2956
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNHelper.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNHelper.exe" -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4544
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Users\Admin\AppData\Roaming\PlanetVPN\PlanetVPN\plupdate.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5964
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath C:\Users\Admin\AppData\Roaming\PlanetVPN\PlanetVPN\plupdate.exe -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2456
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Users\Admin\AppData\Roaming\PlanetVPN\PlanetVPN\plupdate.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5340
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath C:\Users\Admin\AppData\Roaming\PlanetVPN\PlanetVPN\plupdate.exe -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2460
      • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPN.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2836
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPN.exe" -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2580
      • C:\Program Files (x86)\PlanetVPN\drivers_x64\tapinstall.exe
        "C:\Program Files (x86)\PlanetVPN\drivers_x64\tapinstall.exe" install OemVista.inf tap0901
        3⤵
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:5604
      • C:\Program Files (x86)\PlanetVPN\InstallHelper.exe
        "C:\Program Files (x86)\PlanetVPN\InstallHelper.exe" partner-install --url "https://net.geo.opera.com/opera/stable/windows?utm_source=freevpn&utm_medium=pb&utm_campaign=bundle" --out "C:\Users\Admin\AppData\Local\Temp\PlanetVPNPartnerOffers\1590907edebe4ae0\OperaSetup_Partner.exe" --download-timeout-ms 300000 --install-timeout-ms 900000 --offer-id "opera_browser" --partner-name "opera" --signer-publisher "" --signer-thumbprint "" --utm-source "Installer" --utm-medium "pb" --utm-campaign "bundle" --measurement-id "G-V91HQN6VVL" --api-secret "v0P2tywaT_-LmY8DSfzVIw" --client-id "beb336f80c02002e55f1d81c38dfc70d0f7282c1cad8bdf3b0508b024e1a5cdb" --telemetry-timeout-ms 5000 --param-number "engagement_time_msec=1" --param-number "session_id=20260823092826" --param "offer_surface=installer_banner" --param "platform=windows" --param "distribution_channel=CDN" --param "app_version=2.10.106.118" --param "build_date=2026-08-18" --param "commit_hash=" --param "os_name=windows" --param "os_version=10.0.26100" --param "offer_language=en" --description "Opera partner install" -- --silent --allusers=0 --show-onboarding-overlay --setdefaultbrowser=1
        3⤵
        • System Time Discovery
        PID:4252
        • C:\Users\Admin\AppData\Local\Temp\PlanetVPNPartnerOffers\1590907edebe4ae0\OperaSetup_Partner.exe
          C:\Users\Admin\AppData\Local\Temp\PlanetVPNPartnerOffers\1590907edebe4ae0\OperaSetup_Partner.exe --silent --allusers=0 --show-onboarding-overlay --setdefaultbrowser=1
          4⤵
            PID:4724
            • C:\Users\Admin\AppData\Local\Temp\7zS4726F78A\installer.exe
              C:\Users\Admin\AppData\Local\Temp\7zS4726F78A\installer.exe --silent --allusers=0 --show-onboarding-overlay --setdefaultbrowser=1 --server-tracking-blob=NWNmNjM1NjRhODI3ODE5ODNjNWYyODBiZmRjMWVkMWQ4NmFhMzA3NWQyYTAzMDJlYmY0YWM4NGE5ODZiMGYxNTp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWZyZWV2cG4mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249YnVuZGxlIiwidGltZXN0YW1wIjoiMTc4NzQ3MzgzMS4xODI1IiwidXNlcmFnZW50IjoiSW5zdGFsbEhlbHBlci8xLjAiLCJ1dG0iOnsiY2FtcGFpZ24iOiJidW5kbGUiLCJtZWRpdW0iOiJwYiIsInNvdXJjZSI6ImZyZWV2cG4ifSwidXVpZCI6ImZhZjcwZWZkLWRjYTAtNDAzNy04YWYxLTJlMTU3M2E3ZTFkMCJ9
              5⤵
                PID:4508
                • C:\Users\Admin\AppData\Local\Temp\7zS4726F78A\installer.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS4726F78A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x2b4,0x2b8,0x2bc,0x294,0x2c0,0x7ff73f4ce608,0x7ff73f4ce618,0x7ff73f4ce628
                  6⤵
                    PID:2520
                  • C:\Users\Admin\AppData\Local\Temp\.opera\34797e6b-9c6f-46af-98b1-5a9a76571ece Opera Installer Temp\installer.exe
                    "C:\Users\Admin\AppData\Local\Temp\.opera\34797e6b-9c6f-46af-98b1-5a9a76571ece Opera Installer Temp\installer.exe" --version
                    6⤵
                      PID:4496
                    • C:\Users\Admin\AppData\Local\Temp\7zS4726F78A\installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\7zS4726F78A\installer.exe" --backend --install --import-browser-data=0 --enable-crash-reporting=1 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --showunbox=0 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=4508 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\34797e6b-9c6f-46af-98b1-5a9a76571ece Opera Installer Temp\opera_package_20260823093024" --session-guid=33697eb0-f44b-4f65-aa83-19b910c36fa0 --server-tracking-blob="ZmEyNWY5MWE0ODEzMmQwY2M0MjkyZTY2ODE4MDkxZTM0NjM1MmNlZjMzZTRlZWU3ZTQ1MjczMjRhMTQwZTUzYzp7ImNvdW50cnkiOiJHQiIsImZhc3Rfb25ib2FyZGluZyI6e30sImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPWZyZWV2cG4mdXRtX21lZGl1bT1wYiZ1dG1fY2FtcGFpZ249YnVuZGxlIiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzg3NDczODMxLjE4MjUiLCJ1c2VyYWdlbnQiOiJJbnN0YWxsSGVscGVyLzEuMCIsInV0bSI6eyJjYW1wYWlnbiI6ImJ1bmRsZSIsIm1lZGl1bSI6InBiIiwic291cmNlIjoiZnJlZXZwbiJ9LCJ1dWlkIjoiZmFmNzBlZmQtZGNhMC00MDM3LThhZjEtMmUxNTczYTdlMWQwIn0= " --show-onboarding-overlay --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0409000000000000
                      6⤵
                        PID:2268
                        • C:\Users\Admin\AppData\Local\Temp\7zS4726F78A\installer.exe
                          C:\Users\Admin\AppData\Local\Temp\7zS4726F78A\installer.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=135.0.5973.41 --initial-client-data=0x2c0,0x2c4,0x2c8,0x28c,0x2cc,0x7ff73f4ce608,0x7ff73f4ce618,0x7ff73f4ce628
                          7⤵
                            PID:2868
                  • C:\Program Files (x86)\PlanetVPN\InstallHelper.exe
                    "C:\Program Files (x86)\PlanetVPN\InstallHelper.exe" partner-install --url "https://bits.avcdn.net/gen?productid=1968&applicationid=4571&alt=a1f-free-allinone&cctflow=7ac9a186-5c70-4da6-870e-02ebb42d6046&giet=allinone&pps=1062590-121686-21441764_av%2C1062590-121686-21477269_tu%2C1062590-121686-21477268_bg&sourceid=mmm_pln_ppi_008_567_m" --out "C:\Users\Admin\AppData\Local\Temp\PlanetVPNPartnerOffers\1590907edebe4ae0\AvastSetup.exe" --download-timeout-ms 300000 --install-timeout-ms 900000 --offer-id "avast_antivirus" --partner-name "avast" --signer-publisher "" --signer-thumbprint "" --utm-source "Installer" --utm-medium "pb" --utm-campaign "bundle" --measurement-id "G-V91HQN6VVL" --api-secret "v0P2tywaT_-LmY8DSfzVIw" --client-id "beb336f80c02002e55f1d81c38dfc70d0f7282c1cad8bdf3b0508b024e1a5cdb" --telemetry-timeout-ms 5000 --param-number "engagement_time_msec=1" --param-number "session_id=20260823092826" --param "offer_surface=installer_banner" --param "platform=windows" --param "distribution_channel=CDN" --param "app_version=2.10.106.118" --param "build_date=2026-08-18" --param "commit_hash=" --param "os_name=windows" --param "os_version=10.0.26100" --param "offer_language=en" --description "Avast partner install" -- /silent /ws
                    3⤵
                    • System Time Discovery
                    PID:3248
                    • C:\Users\Admin\AppData\Local\Temp\PlanetVPNPartnerOffers\1590907edebe4ae0\AvastSetup.exe
                      C:\Users\Admin\AppData\Local\Temp\PlanetVPNPartnerOffers\1590907edebe4ae0\AvastSetup.exe /silent /ws
                      4⤵
                        PID:2300
                    • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
                      "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 266000 --hide-window -- "C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe" --no-console --install
                      3⤵
                        PID:4732
                        • C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe
                          "C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe" --no-console --install
                          4⤵
                            PID:1696
                            • C:\Program Files (x86)\PlanetVPN\drivers_x64\PvpnDriverMaintenance.exe
                              "C:\Program Files (x86)\PlanetVPN\drivers_x64\PvpnDriverMaintenance.exe" --install "C:\Program Files (x86)\PlanetVPN\drivers_x64\PvpnCalloutDriver.inf"
                              5⤵
                                PID:2896
                          • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
                            "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" service-state --name "PlanetVPNService"
                            3⤵
                              PID:4272
                            • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
                              "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" service-state --name "PvpnCalloutDriver"
                              3⤵
                                PID:1296
                              • C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
                                "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe" run --timeout-ms 10000 --hide-window -- "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1" -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe" -ResultPath "C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result"
                                3⤵
                                  PID:4596
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1 -Operation Query -ExecutablePath "C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe" -ResultPath C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    PID:3440
                            • C:\Windows\system32\DrvInst.exe
                              DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{80c93732-6f58-e34e-a1d2-18fdb4f02032}\oemvista.inf" "9" "4d14a44ff" "0000000000000198" "WinSta0\Default" "000000000000019C" "208" "c:\program files (x86)\planetvpn\drivers_x64"
                              1⤵
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              • Modifies data under HKEY_USERS
                              • Suspicious use of WriteProcessMemory
                              PID:4836
                              • C:\Windows\system32\rundll32.exe
                                rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{935C1CE9-40E6-4597-9146-216F6F92EB83} Global\{3F767AEC-B6EC-4950-8B0D-EEC3786E0BD4} C:\Windows\System32\DriverStore\Temp\{2bdad8e6-c400-2545-9052-629649508270}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{2bdad8e6-c400-2545-9052-629649508270}\tap0901.cat
                                2⤵
                                  PID:360
                              • C:\Program Files (x86)\PlanetVPN\PlanetVPN.exe
                                "C:\Program Files (x86)\PlanetVPN\PlanetVPN.exe"
                                1⤵
                                  PID:3004
                                • C:\Windows\system32\DrvInst.exe
                                  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf" "oem1.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000198" "dc20"
                                  1⤵
                                    PID:200
                                  • C:\Windows\system32\DrvInst.exe
                                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c3e95219-f76a-e844-9648-1b8e9531c4c1}\PvpnCalloutDriver.inf" "9" "43c718b57" "00000000000000DC" "WinSta0\Default" "000000000000017C" "208" "C:\Program Files (x86)\PlanetVPN\drivers_x64"
                                    1⤵
                                      PID:4504
                                    • C:\Windows\system32\DrvInst.exe
                                      DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\pvpncalloutdriver.inf_amd64_c7ce4213c9b7b4d3\pvpncalloutdriver.inf" "0" "43c718b57" "00000000000001A4" "WinSta0\Default"
                                      1⤵
                                        PID:4124
                                      • C:\Program Files (x86)\PlanetVPN\PlanetVPNService.exe
                                        "C:/Program Files (x86)/PlanetVPN/PlanetVPNService.exe"
                                        1⤵
                                          PID:4376

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              PlanetVPN.exe
                                              • Path C:\Program Files (x86)\PlanetVPN\PlanetVPN.exe
                                              • Size 43.3MB
                                              • SHA256 f00781a0945ac5cd8f0829e644ff2bed46b51a2a0a96c7c5ea338214d2b3c2a1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              is-NLWYX14FKF.tmp
                                              • Path C:\Program Files (x86)\PlanetVPN\drivers_x64\is-NLWYX14FKF.tmp
                                              • Size 14B
                                              • SHA256 dcc3ee2b163e215cf28d47c1d0d7e24b4a997e624dfa6b72d1a00a665e29eccc
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              tapinstall.exe
                                              • Path C:\Program Files (x86)\PlanetVPN\drivers_x64\tapinstall.exe
                                              • Size 80KB
                                              • SHA256 315e6c9856072d7fee07929157d74b2496b82dc01e04383559bb6ab80032873d
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 18KB
                                              • SHA256 b7ca109ba82797438f3aa044acfd68318a646be0841b4e03969ee8e774d746fa
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 18KB
                                              • SHA256 50c6862d3c5f2c6afe7d1f7f1e2266766fd2c83f6a80ce772c775908cf8c0a77
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 18KB
                                              • SHA256 94aacaba483af8c2386cbc6435bd312bec07dd0ed28982f00546504faeb203e7
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 18KB
                                              • SHA256 17ac1349e23ae71aea2717a0ce66dad942a41f5b74c6e4da4ec92e0c06fb130c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 19KB
                                              • SHA256 12ec8ed5dcbc8d3202ed8ad53fbb4cb7b77dd8899d67b881ddf37e695d826e9c
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 19KB
                                              • SHA256 621e43ab551dfaa8e8108eb8f7d4d64d6e2ef1bf4357312a380ec670723fda1e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              StartupProfileData-NonInteractive
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              • Size 18KB
                                              • SHA256 486b5a0c1c813e6287ce3f3732e32330864b9f1f79a59a2e02d76ea42bfad1d9
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              installer.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\7zS4726F78A\installer.exe
                                              • Size 8.3MB
                                              • SHA256 b5515de1ce3b119be2992df38b1277c6422e2e7c66c8f10c5755ff3fbbfdd24e
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              __PSScriptPolicyTest_nm0rtips.op5.ps1
                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nm0rtips.op5.ps1
                                              • Size 60B
                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              InstallHelper.exe
                                              • Path C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\InstallHelper.exe
                                              • Size 3.8MB
                                              • SHA256 69a3934ddf1b6092dc34993dd7b9ce2d316338887baaf3a09e175503a9c318dd
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              MSVCP140.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\MSVCP140.dll
                                              • Size 439KB
                                              • SHA256 365175809931b594a295aa9ccc5365ded4ed6d7924c30e439a4430ab449006b1
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              VCRUNTIME140.dll
                                              • Path C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\VCRUNTIME140.dll
                                              • Size 88KB
                                              • SHA256 6bd96696ee7a3d44cc3814e6567b902d7c625ec992ae4542bd06a5eb202ef853
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              install_shutdown_process.ps1
                                              • Path C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.ps1
                                              • Size 3KB
                                              • SHA256 76c70404ecc160cc9ca40e17e4a36d49fc0121bf0dbb219c850c90649c9e43ae
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              install_shutdown_process.result
                                              • Path C:\Users\Admin\AppData\Local\Temp\is-GAV7R53ITA.tmp\install_shutdown_process.result
                                              • Size 12B
                                              • SHA256 12ccb3227facb2290d136fde07561eaa9f98362bab1886cc2aabf6c5031fb7cf
                                              • MD5 SHA1 SHA512
                                              Submit Download

                                              planetvpn.tmp
                                              • Path C:\Users\Admin\AppData\Local\Temp\is-NQYY5YLI8H.tmp\planetvpn.tmp
                                              • Size 4.5MB
                                              • SHA256 adca2c1ac38ff46c34f39d67f212014886a85f32a4f77c979f8f18fd4db25189
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              oemvista.inf_amd64_a572b7f20c402d28.ini
                                              • Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28.ini
                                              • Size 418B
                                              • SHA256 ca027f9caf88ac5c47d3d43c115326c380361439f2fb70c402bf7b5951cf068b
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              pvpncalloutdriver.inf_amd64_c7ce4213c9b7b4d3.ini
                                              • Path C:\Windows\System32\DriverStore\FileRepository\pvpncalloutdriver.inf_amd64_c7ce4213c9b7b4d3.ini
                                              • Size 456B
                                              • SHA256 3432f3bcd27f80c222191df8a2a3daa82d9a69a745d3589b51d4ae08d8a76315
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              memory/1248-73-0x0000000006A10000-0x0000000006A5C000-memory.dmp
                                              Download

                                              memory/1248-71-0x00000000064B0000-0x000000000680B000-memory.dmp
                                              Download

                                              memory/2956-119-0x0000000005880000-0x0000000005BDB000-memory.dmp
                                              Download

                                              memory/3440-1981-0x0000000005B20000-0x0000000005E7B000-memory.dmp
                                              Download

                                              memory/3440-1984-0x00000000060A0000-0x00000000060EC000-memory.dmp
                                              Download

                                              memory/3896-16-0x0000000000D80000-0x0000000000EAA000-memory.dmp
                                              Download

                                              memory/3896-0-0x0000000000D80000-0x0000000000EAA000-memory.dmp
                                              Download

                                              memory/4072-86-0x0000000005E30000-0x000000000618B000-memory.dmp
                                              Download

                                              memory/4292-96-0x0000000005500000-0x000000000585B000-memory.dmp
                                              Download

                                              memory/4828-149-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-47-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-6-0x0000000002E60000-0x0000000002E61000-memory.dmp
                                              Download

                                              memory/4828-18-0x0000000002E60000-0x0000000002E61000-memory.dmp
                                              Download

                                              memory/4828-17-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-20-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-1928-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-109-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-31-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-1825-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-279-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-257-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-242-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/4828-196-0x0000000000900000-0x0000000000D84000-memory.dmp
                                              Download

                                              memory/5016-48-0x00000000050D0000-0x000000000571A000-memory.dmp
                                              Download

                                              memory/5016-49-0x0000000005770000-0x0000000005792000-memory.dmp
                                              Download

                                              memory/5016-50-0x0000000005840000-0x00000000058A6000-memory.dmp
                                              Download

                                              memory/5016-51-0x00000000058B0000-0x0000000005916000-memory.dmp
                                              Download

                                              memory/5016-54-0x0000000005A90000-0x0000000005DEB000-memory.dmp
                                              Download

                                              memory/5016-62-0x0000000008310000-0x000000000898C000-memory.dmp
                                              Download

                                              memory/5016-45-0x0000000002910000-0x0000000002946000-memory.dmp
                                              Download

                                              memory/5016-55-0x0000000005DF0000-0x0000000005E0E000-memory.dmp
                                              Download

                                              memory/5016-56-0x0000000005E10000-0x0000000005E5C000-memory.dmp
                                              Download

                                              memory/5016-58-0x0000000006E60000-0x0000000006EF6000-memory.dmp
                                              Download

                                              memory/5016-59-0x0000000006370000-0x000000000638A000-memory.dmp
                                              Download

                                              memory/5016-60-0x00000000063E0000-0x0000000006402000-memory.dmp
                                              Download

                                              memory/5016-61-0x00000000076D0000-0x0000000007C8A000-memory.dmp
                                              Download