Analysis

  • max time kernel
    41s
  • max time network
    54s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/08/2024, 03:48

General

  • Target

    ProtonVPN_v3.2.11.exe

  • Size

    75.7MB

  • MD5

    550e43665d52c2788d36412981978f84

  • SHA1

    be1157341f0fc1d16b572e869519c9adc5b52e9a

  • SHA256

    eb37bf757a2613e6b5c0d328e9b27c64902249c510d8883593e83ff289794aa0

  • SHA512

    09d996dc3a7ccb6c1c4c1a707bfc59a742f76542058f33ce61bf8bb0b1ae88a9bd9042f199e42de48ccd1867e9c08070920dd6f6a7542f6425c077b7320ea3ed

  • SSDEEP

    1572864:UE8OTLnGaKm1fGChCZ713ueLEV1+ym36Z8bkFYfyxAhm+BsdDq+tl3f1umwQ:aOTSDmQlu28Ag8bkWfuA8ZtlP1TH

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.2.11.exe
    "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.2.11.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:472
    • C:\Users\Admin\AppData\Local\Temp\is-BGQG6.tmp\ProtonVPN_v3.2.11.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-BGQG6.tmp\ProtonVPN_v3.2.11.tmp" /SL5="$60024,78361131,1119744,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v3.2.11.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\Program Files\Proton\VPN\v3.2.11\ProtonDrive.Downloader.exe
        "C:\Program Files\Proton\VPN\v3.2.11\ProtonDrive.Downloader.exe" "C:\Program Files\Proton\Drive"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2144
      • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
        "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" /lang en-US
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2624
        • C:\Program Files\Proton\VPN\v3.2.11\ProtonVPN.exe
          "v3.2.11\ProtonVPN.exe" /lang en-US
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:4628
  • C:\Program Files\Proton\VPN\v3.2.11\ProtonVPNService.exe
    "C:\Program Files\Proton\VPN\v3.2.11\ProtonVPNService.exe"
    1⤵
    • Executes dropped EXE
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2252

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe

          Filesize

          11.7MB

          MD5

          89f0ff7933d9f05e52d354e1c19a34c7

          SHA1

          ae1c56284f6efbf3c5af3cf2fb23ae0e4fd7f8e1

          SHA256

          ed3c8d4f6703e1138f22d4df73dfe50ec31474cf126ba9fbc590a37077ae99b6

          SHA512

          0b39f0a14ae11a9b4293e2b76ee73528ba2d347318f85e6036dd62adec8847ad4e35d91a6dda35b12fe6db5df01a1923737acf5bd5214226ee5c0bc63558fd0c

        • C:\Program Files\Proton\VPN\v3.2.11\DirectWriteForwarder.dll

          Filesize

          512KB

          MD5

          a44133e3dc3abd473f7c047538502a46

          SHA1

          c8666bec92653f233baf9e944a108bda3070d18d

          SHA256

          a32e39f506885feab67255700a797703040ecfdbefb4a80df81c17e8331e0964

          SHA512

          75afe85d74a7d6799df0fa9b05c4ecc515df28e81e667a41c03bf64d31d4f40af548d9afc88186ba7bace02e66b07b990b970406574c615fa918d13641ed2e12

        • C:\Program Files\Proton\VPN\v3.2.11\Microsoft.Win32.Primitives.dll

          Filesize

          25KB

          MD5

          f2ee7789e09626a24bedaed958b85ea3

          SHA1

          a83f9ea943e8a0c90befe839e81ad52bd18c21c9

          SHA256

          9f2b9a9bc6be3d13cdd03ee3e860901e37ec348e7565b14f1bab13590ab0d3d6

          SHA512

          cf0597e39c4fd93b0a7449e64afd724cf3d3a388a3c502ebe944782d00efdbeabbfcc152403eb3ba8ded531b1d7cd37f4532e455af4a5f1c3a1573d89df5c7ae

        • C:\Program Files\Proton\VPN\v3.2.11\Microsoft.Win32.Registry.dll

          Filesize

          85KB

          MD5

          cf19b89edcddff601aecc9212feb305e

          SHA1

          8643910ba840dc241b327210551e1b9944b9f7ad

          SHA256

          d59189746f362cd58d74de3585256242e9620ad67891d42dccf567ce2e0dec62

          SHA512

          19e1bb0be8a8d39425f61ef15e512664b18771233a8837c1920ed076c6ed18f7bb39456b58fab86e5af468382dcef1a65dc4d9047b7d6f15199ad454e673ebf0

        • C:\Program Files\Proton\VPN\v3.2.11\PresentationCore.dll

          Filesize

          8.3MB

          MD5

          e6f19c31e8154784a873f5ef71cbe531

          SHA1

          9a43c006cc186005960b34b804267524ace6db85

          SHA256

          27c3507eea90e8f385a45376445c57e44f3e474b0937609ea40e758432cf37d2

          SHA512

          d12d07e08939051cb8746318a0f856a03d8315ea1973859627b80aa3fac80855daf5100c0c472a5cfc169b88ce27d566a70475095a02751ee870b0cf733853e0

        • C:\Program Files\Proton\VPN\v3.2.11\PresentationFramework.dll

          Filesize

          15.5MB

          MD5

          0f050890212acdfc6d6d4f29ed0b2e6d

          SHA1

          2010f4bb2d7dd4836d3a56a5d2372615563d08eb

          SHA256

          ed36e1c734f596b33003cb3769b2570eb73529fabf791d0fa539a16640407008

          SHA512

          65d47a7f913dd714baef7093ab69ce4c26ab4e2631411d4fe48b04d5a1197d88da1992f17c3e697efbe54e646dfea99bc8d8dc730f5262872e5cd7048c385e5f

        • C:\Program Files\Proton\VPN\v3.2.11\PresentationNative_cor3.dll

          Filesize

          1.2MB

          MD5

          aeffae9ee6610a1b941cae781422a177

          SHA1

          23767efd808cf1b0a19d8a4fe19998c74ad1e4b3

          SHA256

          2cdab1fc17ce70595586ab91b87c1c4b2dee7b2b462f180f22f4682fa4ddf4bb

          SHA512

          187c6a091fc305323bab2c1feee6e71461b06d13f93a02c8afa1850505d292f7ae7362d8e13c96c5b8058e8e246c28f76185f6f9f76ae91ba9b40514f069f858

        • C:\Program Files\Proton\VPN\v3.2.11\ProtonDrive.Downloader.deps.json

          Filesize

          42KB

          MD5

          b2aabdd5530c5078269b06901eddd5d5

          SHA1

          48ad44a0778b808f1d51676372a08b3cf6bd8831

          SHA256

          4a247f5374768c7600b96917c5f118596ec16b5b1fd29c4e6d4998efe1fd3526

          SHA512

          c0e0996d54884197927d96924b94aa4a182076a7d1a287929f3fc01d7c8d432e502bc65a473f98e0218a17cf89fd90319bf93a802b78cea1237bf1d663502b97

        • C:\Program Files\Proton\VPN\v3.2.11\ProtonDrive.Downloader.dll

          Filesize

          221KB

          MD5

          c65e2574ac09b05f6f97e1f78bf3303a

          SHA1

          615ea7c14671079f18db998e8c16296d81c10b32

          SHA256

          da9b2ce0970e646e204c07bef40b85c0a68e2b9aa1b5c74e9243b37a4021892b

          SHA512

          2e6e260a2099c6fd8801c4faf50edf22cf45e697c794257e7f97be8ab8f2ae242921325328a77fd503173e4c3ab52078fb16fa023b7f55a0dff7c3d43d741d6e

        • C:\Program Files\Proton\VPN\v3.2.11\ProtonDrive.Downloader.exe

          Filesize

          322KB

          MD5

          8919a5252830aac7848edc4716fb8f96

          SHA1

          7b66d235851cf333d450d50e706bd6a27e113177

          SHA256

          9d95738b319614fc320f7784adc3636f5be947d690c74b5127f056407cda947a

          SHA512

          52143256c5e9b4c5ff6c3cb76f1dd6f41946de6fd8772e15baf91eef97b03037c1545ba1507dbcadb65f4f1806821f825e5a635414496ae1bc035ca0a7068f96

        • C:\Program Files\Proton\VPN\v3.2.11\ProtonVPNService.deps.json

          Filesize

          172KB

          MD5

          60d0fc9be2bb280e6e0180263f5c5eec

          SHA1

          02b70fe8c665432d270975904bdb695691a4a911

          SHA256

          212e78448f79af44d6b55a53f3a3e69d43ed20d8676e1b2ff1abc750b7e3c729

          SHA512

          9a3067904b9b999ed5a03b383e4a405527398125ec5d54efd898cf6fc687a518d3a2e30d8111313e9f8ea168ee446939f1c44f4e4484e23de5ad5455b0916c81

        • C:\Program Files\Proton\VPN\v3.2.11\System.Collections.NonGeneric.dll

          Filesize

          98KB

          MD5

          e2311907c521f46c510a34aa084ce5fb

          SHA1

          a16e6fb00b5e3f041a6f93797b94d0d0ea11b86f

          SHA256

          697d5886477da479a0003e7123ab715b7cdd5d524dde8cb839f08b328b7d055f

          SHA512

          95c4d8ec94ed2b3b74b7ace911cfe86068345699169ac77e2e24ec11ae86a2945deeb5b1741958c17a9c8cf7f4086a03654930eb2f8934565546ea86967d4332

        • C:\Program Files\Proton\VPN\v3.2.11\System.Collections.Specialized.dll

          Filesize

          93KB

          MD5

          5b36825632c9c4832be5cab8d8d05f0c

          SHA1

          c2bcf188359ce8bbe8d8e25d89d32bbec858217d

          SHA256

          6f55e08ed6e942680552471d8c98f1f11ae25a38e7a1563d704444529e4110dc

          SHA512

          3176b5ad041a48b9c992670a5d69f46d82c0a5824139e1f8b38a7d9230b5a88996143ee9178a0713f2a563cb8740f2f952cefa725cba84215df66d5fbd8db9da

        • C:\Program Files\Proton\VPN\v3.2.11\System.Collections.dll

          Filesize

          258KB

          MD5

          f687361f2dc8c90597557c311c4ee1f4

          SHA1

          2a7cfc6a7e9de416d63836d79b642f92b4ce490b

          SHA256

          bd70f91f77879c3f3e287ea1eb8e23b2413a938fc61459f766b03865a56fe1d8

          SHA512

          395c0ddbc977cd7021667907640c8ade41dbc5ba68ae7266303f8b49b7ccfbf226badcfef3bf24ba483793d3fd1b74187122c4645ac5cbe1b72b228390548817

        • C:\Program Files\Proton\VPN\v3.2.11\System.ComponentModel.Primitives.dll

          Filesize

          73KB

          MD5

          de8b91cffb07571067c82b5b1ca8b9ef

          SHA1

          0f5725b846f7e1b9536d520e0dc40f31ac658c51

          SHA256

          0da88ac3e50fc1742ae33d254429cf77a575459f9b8cbf2e6d2790e0fc435123

          SHA512

          0c31f7ae813f9da5fba50971cfdc6371a9144aa5a4fb1b37a7d503961045bf80d7457526ec19b12b828afe275f51eea3dceb9d44db2fec7a3b200b05a807687f

        • C:\Program Files\Proton\VPN\v3.2.11\System.Configuration.ConfigurationManager.dll

          Filesize

          415KB

          MD5

          8142dcde6449f3a02353dac33623d570

          SHA1

          6bb5c358694c7856f037b4bf9697ff210573cd84

          SHA256

          38cc76d6bfeff7201e8c4e55d05a1144949601d35fea156f915f4a0f3aff3660

          SHA512

          7408447e4f844f071e2bc294dabbee32c9c96a47ce055ee653735b6d332311d7d9c18bdbd86e04fe378efc75d0cd8fd8652b837174b3b6b7cd166ebb52412765

        • C:\Program Files\Proton\VPN\v3.2.11\System.Diagnostics.Debug.dll

          Filesize

          15KB

          MD5

          3b28ad5ad2731fcb1f7b0d6961520e45

          SHA1

          3c748297ce5ab4a8dcbd57abfb0bf6f3c466f18c

          SHA256

          394eb8a62569f42ea6ce80a4d3ec892668f60a9330887b960daa0b34ade8e901

          SHA512

          be88d5e3f05dce597731989f44fa95077ad3bce47a2f1e2e026f35af3dbc69008642028e499169fb8bafde84681c2ccd1531349121f2317835bcf3258e4a3d46

        • C:\Program Files\Proton\VPN\v3.2.11\System.Diagnostics.Process.dll

          Filesize

          283KB

          MD5

          df2bc26505a4ded327a20ba1363a4fd9

          SHA1

          4d62119c3f8c99374dca9a3643f580bb9148e446

          SHA256

          94990ec0b5a7264f13844c04340b69bd87f5ca06950e8199fed7122efc5dd66d

          SHA512

          7ac275be2da34776eb73569ce187041f277f83783497f69b22eb69725961f6077be2d3fdccf50fc89c93ca8bd8c4671bc62853f5960e2ace41aa76bfc08aeb74

        • C:\Program Files\Proton\VPN\v3.2.11\System.IO.Packaging.dll

          Filesize

          273KB

          MD5

          e9bfc3fd7d2c442844de148c39f66280

          SHA1

          60a6acd88c984f10bbf27f5c31cb70d0e0f01a70

          SHA256

          86667c3caf04fa28013cb854d5f1a50ce56949e034754d88dfe743ee3439b4e4

          SHA512

          6f4168719b410b95946869a1ac1a370aaa2210d24fda2448cfe0295d78d37f3cc8da18a8a0317430e29aa958892882ee25e2f5dd8e0d1481feef394b88912e26

        • C:\Program Files\Proton\VPN\v3.2.11\System.Private.CoreLib.dll

          Filesize

          10.1MB

          MD5

          cd1cbd2a66aca4e53419357e84837b32

          SHA1

          4ac5ca7cb6a9f8c4d58172188185abbe76dcc995

          SHA256

          eed65437df311c58937d34491bbe0b52a704aa5a900a5aa80bd2c20dc52989b6

          SHA512

          d785da82d5a0270b94ab05e8961bc86a47240990c3c27a9be48745ce9decf40361780eb7285ab4cba738242c30681e4235a0d6dd65ce64d56959a4bfb6ec283d

        • C:\Program Files\Proton\VPN\v3.2.11\System.Private.Uri.dll

          Filesize

          246KB

          MD5

          3ce30c524db23de721215acc7d80b698

          SHA1

          f4beca55bad70305fb05d988cab7e7f0e9371613

          SHA256

          aff7c2c581e4a998d3c77bc537724e2e189532de249531d706d3fa51121b934f

          SHA512

          77894581ffa16223e32eb1075225f17375bce38eef1b8c7941acf8a0fc81fd3cff65371f0447229382e5c30c3acba4c5af1b482989ba83dba735aa02b539cac9

        • C:\Program Files\Proton\VPN\v3.2.11\System.Runtime.CompilerServices.VisualC.dll

          Filesize

          19KB

          MD5

          a73e3c49bbe8244f2a99cc5d89c7c429

          SHA1

          a790c47d96bad3aa2cee60e8aa511dc4335dcf24

          SHA256

          111c4f4814f284a8e4befca0616cc58e310854cfaed4a1136bd7dd157f210ec5

          SHA512

          c5a5e618207952ab05f7e280fe77ad966a1c46a0a4cf0c72c4cba663990e7214761c716652cb61e574232a933a6208bdb85bcf0b194353f3aa54226f318a0435

        • C:\Program Files\Proton\VPN\v3.2.11\System.Runtime.Extensions.dll

          Filesize

          17KB

          MD5

          bd30f3a1bf86a20ceeead4f4844387c7

          SHA1

          7c2c5f545358b234f49b9ffee78212436e210905

          SHA256

          d57b59997925b2e63cfd5b2845c459f8a6a923233bdd1e7ae78fd5870c669cf8

          SHA512

          510bdb64761d12c80c780741182891efe14e47cf02a042020533fbf56a628a5850dd68c52506426194a46f58ba19257c54b39aed39a364085eaa55f9228b83d2

        • C:\Program Files\Proton\VPN\v3.2.11\System.Runtime.InteropServices.RuntimeInformation.dll

          Filesize

          31KB

          MD5

          5a2bda88d61e32384765e0b7ab387caa

          SHA1

          348a1f54cca7dd551013ffa22e6d27185451b85e

          SHA256

          affb47793654e5541da9f3dcffa6a0840f10594e3f6ef9bdfd902464b825732b

          SHA512

          de57d3e97337e677216bb5a7838e32c028fff1da2093d0200a757895de77d978000ab6a5d8bb232cfb65b2fe95f3b4cfb79d25cb4b1f30efdac731a4ce227801

        • C:\Program Files\Proton\VPN\v3.2.11\System.Runtime.InteropServices.dll

          Filesize

          50KB

          MD5

          e58537b2b7f0143bda57d8fa16b062a3

          SHA1

          f2a32d67a73974b9576d9df455efe870005b8001

          SHA256

          4c94f80f91254c0c4e111707da05a2457913d000bec88d861bc1c8230ffd8d1b

          SHA512

          2301174328131910dc71f37de55ac9fc2e9751c2831e39b5be18e257a71bd67efc4f17eefa27d7ec9de3ade0753e039266dec2763fbaef383e5a8c8aebf8a767

        • C:\Program Files\Proton\VPN\v3.2.11\System.Runtime.dll

          Filesize

          41KB

          MD5

          d493b2e3691e0f8c7ac457b096f3c1cb

          SHA1

          93f458d067249f9dd2efeb762c275d0311b2c7e5

          SHA256

          4ca447a6c7666de87f73a76ba2a22e347f7c8ff3461b93752c6f79f0ccfefb4b

          SHA512

          684283c7fa97a8964260c64893886f267fe1e8a6b6fc8d568ab3242855a80cdfff5b4ba8ce2805fbbb1a4852e88d926f1ed8d87ef3d9b3f70e40c3a4b37e7707

        • C:\Program Files\Proton\VPN\v3.2.11\System.Threading.Thread.dll

          Filesize

          15KB

          MD5

          83e7664fa355134ed4baed691511123d

          SHA1

          3262e7ba09bac1fe57b83e8668debcdd532fd3af

          SHA256

          6d3316914fcf914df36ba297c7ff2d10c65752432c5c0c457cb48d85a9d0bff1

          SHA512

          62769a4cc68a4d546c288c41c38800c10165f9ee55284ba1b8cb0c8bae9169419f9515bb42617e473e227b6febebca4f29d28c7b0e9643a9254bbe938060eb0b

        • C:\Program Files\Proton\VPN\v3.2.11\System.Threading.dll

          Filesize

          78KB

          MD5

          dc0cf475432fde4bc85a7f414b56cf17

          SHA1

          c3f4f2d84cc9ee4f8f7e3cd9d2b089d0c6a00fac

          SHA256

          8046a9a6c5e1ebc579ac97fba84831cbe94dd373727388702380ffd2e6037b00

          SHA512

          3f03ae7ecbd420948b4b90a907cb61ec1cbeb2dcbe521341aea282597f12d09500f2640e0870c8174dd63e48a633ba45f5106104f4f73cb307957c3e226b8a9b

        • C:\Program Files\Proton\VPN\v3.2.11\System.Xaml.dll

          Filesize

          1.4MB

          MD5

          8a07d51f0e363121340429efb491822f

          SHA1

          5f8066d5605f813916b07c3cc06fa9f0ab9f5b8b

          SHA256

          326273fb9852103148f1a79b98d489c9af3115e04b4ce0ecde7a7a87276c4a16

          SHA512

          4cf736dd8d6a3e97dfcc86f7acc0a0ced19045109ad88a52c8327db325df226878a9bb0684b0e81590cadceda885002ed87f01a5e11d60d9437d7cd1908b2754

        • C:\Program Files\Proton\VPN\v3.2.11\System.Xml.ReaderWriter.dll

          Filesize

          21KB

          MD5

          4692e0e050a771e53c051858dc62cb73

          SHA1

          c5045f8e0454211049cf5db839ed4b52b6bdde23

          SHA256

          2b23170c4fb20a3a401d725851d93b49d515735e96a012adfb412769f39cca9c

          SHA512

          f1af05ad38c9da1cccae6c9315c04bd143f855c8389469eb75da0f11f7385f94b15b12467771e3fd722579141f0ffc2dea1689acc3ef5be48ba583d08d59919d

        • C:\Program Files\Proton\VPN\v3.2.11\WindowsBase.dll

          Filesize

          2.2MB

          MD5

          050dc5a86523712f8872d099654b6a22

          SHA1

          bf82eddacae716060abcb3390abc7573fcd9a986

          SHA256

          c253cc56b761dffbce3619c842645b1eb5d7531301d085249984fc53b785d1f8

          SHA512

          c0c1bddb6c2411d0b0e0ca08509dffbfb87078ea03c1bddeac5da9aec13cc0029ce6eea53b4e34c0b2be67049f450e780661aa470bdc75976b16b22adaaf256c

        • C:\Program Files\Proton\VPN\v3.2.11\clrjit.dll

          Filesize

          1.4MB

          MD5

          64926c3fa660f6f0dcb738335e61ec84

          SHA1

          5d97bd9d0f2c61b669730f872122a1a42f7fb5db

          SHA256

          20fbdc406e0f36d1320a44e76f0d4881b86cfb18947a7f8e4e7acf8798a1534d

          SHA512

          0cb4197a817699a2ace0ce6a3bd1bbd825bda72c2f29fae0a8bf234a8ae849a6e6fc75117b9fddc4ccaa71f6b18cea64938d0ebff7277f9aad712b25961d65a4

        • C:\Program Files\Proton\VPN\v3.2.11\coreclr.dll

          Filesize

          4.9MB

          MD5

          6ffa88e2df9e2d543239985832c78181

          SHA1

          b6168e470c68095e803ca827fe35d59daf827bce

          SHA256

          7fc775e076b2cf7021fe38058ff782228926ed45ea79a687d99b6bb499c3b7f5

          SHA512

          1fb2958a6fb541d046801a8c2ce73cf8a39901c32b84aceace70c8d93fe0a9ca24cbac5ae93669e7fa4ff1978d124baa782e39750f64cbae99ed3ccfac352052

        • C:\Program Files\Proton\VPN\v3.2.11\hostfxr.dll

          Filesize

          369KB

          MD5

          ee507878a7e2579d2bfda2d03fa84465

          SHA1

          4e9c9ff4f2672012612ff9f27ade39fa264d337b

          SHA256

          0b0aed1f8f291cc81d2334b649837ca1d0f13d14d58fbd19cf3a282e80f299e1

          SHA512

          569e1036c930a401983747eb9d7c1aeff71e359d7d2e0a301479c255f24fdfb9e41b3585b0918dbaac12e2b5afc3f5710455fae1222adde763850e0364cc01ea

        • C:\Program Files\Proton\VPN\v3.2.11\hostpolicy.dll

          Filesize

          384KB

          MD5

          19167bb1ae169e319e62aa8a11bf2122

          SHA1

          4b7942151c595ffa3b23a2a954fe89823e34c8a7

          SHA256

          b6fd2e79738e993263efb4553ed9a94b98300c543f7c0d38a0bc7bceae9fc2ea

          SHA512

          599e1c792490b0e9a95be06224486c0c694bd2a6d5970459875c802a7143ebdd727f1f7f316282afd64934d5d6932b91fe22a518000f0ef930140a0e7aecfb2c

        • C:\Program Files\Proton\VPN\v3.2.11\is-FTNN5.tmp

          Filesize

          540B

          MD5

          fceeafc460df5609a1f10921b03da7d7

          SHA1

          dc281c4a126df181e4330a4cdfd9e43bf39997c3

          SHA256

          1b8a0096c02b3f1ddf6756a3b112b4e5a3ff7698b8500eadd28298837387c60b

          SHA512

          b5ea390511370f27e761269c8bc25f1f2fd0befcce9c1cc6a919f319220a440c1203954703eddb373d35e96ef73aeb3a02b35ee530b63496735cc877bc7d186e

        • C:\Program Files\Proton\VPN\v3.2.11\is-NA7UA.tmp

          Filesize

          453B

          MD5

          0f699c934a98f229e08b805ced7e265d

          SHA1

          191e6e106081033b448d0ccb32b5d6a81d6c8d63

          SHA256

          a0eb69194b1819658ba615351a79859707d3a5cab440bdfc26e015a64ddc7b82

          SHA512

          0ad0d5fac9bde0eaeceff4b60be75df6e6f2745670d56da5674c96b179b609312ef1c66a94ae0aeb7566bf9ff22193556a3817fdd7a29c777322521db7aa239f

        • C:\Program Files\Proton\VPN\v3.2.11\is-RO88B.tmp

          Filesize

          267B

          MD5

          aee6e7a5e5e35b52c9feed7f45645d0d

          SHA1

          525ce55d12ceca073009ec64281b6629452ff739

          SHA256

          3de6b890d0878014ac37f4807f8354d479c6e4ae6f96452564049379b57d0484

          SHA512

          0133e05f7efbbf9c750576a4447473df70bcf0a4a6f9cb68476eeb139d98368ea314bba8f7f812e3edc710dc3204f3cb894bb4851834ab5ae76852c23edfb023

        • C:\Program Files\Proton\VPN\v3.2.11\mscorrc.dll

          Filesize

          143KB

          MD5

          4e9dfc286b3d1a5123e68aa937da21cf

          SHA1

          faeef31d79135c8e38744b5b0d08fdaa101776d0

          SHA256

          642f650fd5d3520dec37c6ecb96f6566d45b81ea196cd4a293bc33c12a612743

          SHA512

          32b77bb9fb0cd5b7057663dfb8c750db266965de7df866212600d1afae14d106c26ddba9c1f60b191f42db0ca01e3e9ebf0d429f47f5dccdf72a6f5c2306e704

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\1jb2hspv.newcfg

          Filesize

          1KB

          MD5

          fbd825d212747dbc89cb176f80a8026f

          SHA1

          f2647621757f128a61aa4cbe8763effa4856e983

          SHA256

          86d52693f3090abaea1d23bc44deb5b17b17908491b2b6a83709365270714fa3

          SHA512

          179bad00b347da46db8f8ea0cc3ae8fbcd18cb2de652aa35394771cdc70ff52b3d2293dbb3bfcdc98ff68bf699a440925cf3d6b7c1ff4280e57eadfce0f5c862

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\5d42uenk.newcfg

          Filesize

          1KB

          MD5

          5f94e48a8cd4c9a188e5058efad6273e

          SHA1

          b3a5200039dca2282009c9abb3d511259ec0e554

          SHA256

          2a9aa18013d9a127cceef3b0503674588dfe79510d0de494fe829a9376b2a683

          SHA512

          b042ade5b9566cadc8717b93c92d9fa7c3337bab4eb801d0d5033f943d1de912f8c23555dfba10195c0841bfbcd4759c8b4bbb719acb0be386951dfdc18eff58

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\a3auiczx.newcfg

          Filesize

          1KB

          MD5

          a07ceb90581e75dbf74f24279befad43

          SHA1

          156fb3a4442452250327f21a6c4cc9749e2ad056

          SHA256

          13f0676650e6540bc5fe50b24620a38b9a39a8980d5d2145f0152f98e4a2d47a

          SHA512

          e7a68460a8d348f33c783a9e2c9ec76ba79e12dd59cd05825c544c7fa724f644d0b6e12653fe9efbcf1813006e7f1a4f23be58fc94878403eb4e7eaaae8ed8a3

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\avmuwr1w.newcfg

          Filesize

          1KB

          MD5

          2abb91eaef39f807c2baf0ae9c1ed72f

          SHA1

          abba6eb4369223ee9c4777b268d8ae8f14af8603

          SHA256

          a440943c6e415e00161ae0da4e1364f694fe94c9b7da9215c4a4aa9543220019

          SHA512

          5f22a3903501e276214759eebffbf1375211c2c337df74165112517eaf06696d025dad55be93f0f3e6853b12ab8d949d15045226e36e9d37dd40855834fb7c8e

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\c5x2d0oe.newcfg

          Filesize

          1KB

          MD5

          b83f06094b24d3862afa804ef0829df5

          SHA1

          7aaf7b58c6f322008bf479d74f39949899a846e1

          SHA256

          125b8dd49d74312c829c48fdebbc6252453923871c645665bce5010048c41fe9

          SHA512

          e607e08dfb4f7c7665dca3d736f68cada4f17d786deb514fff8538861d920a68123daf3734f19cc8255b9245336c6f08d295cb250382f8bdb0b6161bff0c422e

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\clvptrlt.newcfg

          Filesize

          1KB

          MD5

          76bf5ab41ed249b6f3cce8a1c9605958

          SHA1

          19671587a860ba5619369393b0e8981dc7f39142

          SHA256

          6f9d1f967f77b4e49c4b2bb7df74b2cf608cad8689428a7d2d6470500208e1ba

          SHA512

          0383fd85d0c046c55854d5b9bfc75427203928786d927ba51b35786dfa57b195d8c8a4862e256a7686f06a49acf59876bc6cb693c81edfcb9165566776499ab5

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\dnleqmsf.newcfg

          Filesize

          1KB

          MD5

          5c260c34808aea41ea1facb6d46c0000

          SHA1

          489ea70d8fbd689d4f745f9e74f017fdbe33e1d0

          SHA256

          1f8e6c69f24c5c51d6ce6c4ec0eae7fd70ce53b4f537aa970a05cdd4eda7924d

          SHA512

          b7e72020e01a9bd884942b59fa58149c4def928bba41a431f8e5d68951f080031dec42b07b08f7354e6435b8a11b163f5294c15696127981db69006b7a96c31c

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\iydw1ste.newcfg

          Filesize

          1KB

          MD5

          379ce4d1fd30ed344e8316284e15879d

          SHA1

          0f2ef8cf4920541317f4fee8268a94aee82ad717

          SHA256

          55d8a5a7b4ee05aded973a561f1c04c0377d647d4dd9a6b971b424dad2c45333

          SHA512

          f6c43e4655fb4cd21d58224eeace12fa520a9af3b5bb2d91216559a3063f7513a68813303f8ae655a4e547f08720c5e11388e847a827c77a2f24371afd8da359

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\kwcegsgq.newcfg

          Filesize

          1KB

          MD5

          4298602f5cd2f0d39311f36c81a3e0b0

          SHA1

          80e937149eccef32eb5b59f8f532046125386d82

          SHA256

          4dd9c8f191a42d4fbae77fb11fc3d28d360bafb91935bc230cf3289d99d8f70c

          SHA512

          92a8ea18ae6019ab57e64b0e25d82aaac134be73637fa462d35360cb87d403f95673349204c61678b8925bf0e0ebd9ae706ba396569a5857b86135c26ee1f6b9

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\lywcphzm.newcfg

          Filesize

          1KB

          MD5

          5e138f5556318090ea9532254cfac073

          SHA1

          1bcfaa1a1ca320ce412c71ccb7fa7eb2ffbad231

          SHA256

          4937feaedc8a0991a97b0fe1136b9d935154f10ec3824a9298b611a4e30459cd

          SHA512

          ffd95f0f53f0d3b6a786a62e6951d656ab4771adfd4b9e2d8fea73134d1c7b3f6220d92875c25cbece1af8360d2543bbd0a09ac426e5bcb988c013d623032cc5

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\muymdcpf.newcfg

          Filesize

          1KB

          MD5

          cee12bfdd59139da4e05da4da96e05fc

          SHA1

          f6c6ec37cef0b26b03a22b15497606e72338a01b

          SHA256

          e3e5ae5c5bddfdfc4cf22376053309559a34412e1d84f90dbdbb68aefe266f5c

          SHA512

          b7df4a50273a3e0329ba11e852d64b6913214d06719edfc72e70ffb5d1cfd3bf88d6ebb7c3c69db41293442be73dfae84886a3980de2cc7788b6dbaefbdb7ee7

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\rzb3b1i1.newcfg

          Filesize

          1KB

          MD5

          5a9cc4d0c6e0c97b2f7a4ff8b38b5210

          SHA1

          f3aeb04306401430deeeab18d8c958f72f8a0dbd

          SHA256

          c2006c8d9e57669fafc4f28bf80b8885eeafc3b48529d4635156313c653f1c03

          SHA512

          7b3a332dd94cd5c5cf3eb7184c40ecf60333f9e9e1ce3bcd35acec115596905fc2e2558b62cffd68a6f857056d7c00da2c7459f3c26014dea28ffda354496afa

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\tpgjkij2.newcfg

          Filesize

          1KB

          MD5

          e45291d8c2e56bc7c36bec4133c6079f

          SHA1

          f17fd363b97917aaadba115305b78423362548d9

          SHA256

          0976f545202cd7a8485046778406c5afdb7abbfe0ef8cfaa0987c909cae47ba8

          SHA512

          dbb455d0bdaaec13c9d2ac233d7906e17a59ca1f466c27b37cd1cd8d0e979d5097011ad2946b4a42032640d4426b397f9e89322db2878f9705fe9c4f63f50230

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\user.config

          Filesize

          1KB

          MD5

          58715fbf0ff6f621b2a0c763b190746c

          SHA1

          3b5803f6f1c7345ab8ab06f7a273917fff3dbde7

          SHA256

          8caf69542b57469cdf1ea15d40c46b95365f3526aa3903a4763ebfbee6d5e34c

          SHA512

          62cc7fb781333276ffdec1106d9138c96c6e4eccc94a74337388a9e9eaf361406e0a2b458e931d8dc856d8090e76278fce50cd9c42a4bee6567507fcead8681c

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\uwvxuvvi.newcfg

          Filesize

          1KB

          MD5

          5a38ed36b4e164f8880dd3a233faefb6

          SHA1

          20101c9cdde67382aa893bb2bbc51042c394a576

          SHA256

          fd91a260930d57113158a37a66bdf70ae70a1960f7b34713c56f7b88425022d1

          SHA512

          63e00ae25890ba72f7bec685044411f4ac0c957d174ebaf276662f4740ea2b48ec6c7be810e1f221dd64e03b613b6d602399ddff083aba67ba53bb5ecf7a099d

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\vkpblcdu.newcfg

          Filesize

          1KB

          MD5

          73d567d3ae4d284312009e4900d2bf7c

          SHA1

          cacdd106cd82b4221802368d821188a3767b0d60

          SHA256

          525b1146ba124446ffa9bff73f767d40bcd33afcc982ff833e07f8346f8e9c96

          SHA512

          3e92eb619d813b0737c5538bd3b16cc51e362fc1cd51b51159f65ecf97370bccdc797e9b7049735086ba17d5150c7d9209ae55ca34d64e66437d211ce688fd2c

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\vqp2rvki.newcfg

          Filesize

          1KB

          MD5

          03f8664bdc033fd4d43ccec636e8ff01

          SHA1

          8994f783e3fbe668b125f506381edb2459723b63

          SHA256

          43a46198567bf769e37195aaf5cb302d13f47b8e908d90c91525f4899ddf7ffa

          SHA512

          4b51f2cc8435aa26d41c8bc4db407394614386f1a9ee738ef20ae562afb72c0fbfea524984239ff7b95b554eca7e3b2fd76667e8306ce9a0c75215698444e325

        • C:\Users\Admin\AppData\Local\ProtonVPN\ProtonVPN_Url_cmnccr2xp2ofmvhglly0haihuyzzqh0i\3.2.11.0\xgcuvfbr.newcfg

          Filesize

          1KB

          MD5

          ab7182505c7c552e173ddeff90b7f168

          SHA1

          9e039af8de929ae837bd89aa9d1789a42b39a728

          SHA256

          a06e8e290d10b57f21c2003255c4ec9bd03fa814a352582e76f00335c72edeaa

          SHA512

          cd4afba6a472fddb2c67c14aee41596508c9cbd990ebd6d5362bab40127a7bb6acf7fd7410cc8cea635df1e05541339cca11c29a7a9b0da60021dbeab24e81b5

        • C:\Users\Admin\AppData\Local\Temp\Setup Log 2024-08-03 #001.txt

          Filesize

          226KB

          MD5

          d7cdb989129aa1aa28796f59b23c5ff9

          SHA1

          434b0027ca49ee74d388cd518448c2451fb31d01

          SHA256

          edd470eaeaf34dd89a9245f86d0b035c8192db32c8312062182b32aa1a7c9a36

          SHA512

          c07e94f272244a2aba73a79f2f9b14c91a146d8bee55ce325768d160e00feec84ab7fbadf4aefb65072a2a23a7b71ed5dd9af22ba7c00b140e419084ca9d1bf1

        • C:\Users\Admin\AppData\Local\Temp\is-563AQ.tmp\ProtonVPN.InstallActions.x86.dll

          Filesize

          562KB

          MD5

          c026ea86bfb609d354bc0fe7701e0bec

          SHA1

          cc55fcd83094d0f05bc97f97a4ef50168be47391

          SHA256

          efff858e17d6a82ffd1b34445884208305e31c36c6a9cef509f67f0cc2d7e369

          SHA512

          32fc1507dc52b263ae7ed0008bf92cb7f0944d6d5afc0eb8ba065ce55a0b4f366bf3affcf0362a59b438646d09bda85400e363e877284a9ae022ab4cd7c57d3b

        • C:\Users\Admin\AppData\Local\Temp\is-BGQG6.tmp\ProtonVPN_v3.2.11.tmp

          Filesize

          3.4MB

          MD5

          6760378807a18455aceba9a13b33306a

          SHA1

          8a7f64422f2e71cf24e79e6b014b325ea3cc6aa0

          SHA256

          587896eddddc7554571fbfa9e430a99176b06f56fc74fb15d1054790f01a058d

          SHA512

          403092ab993110cf119d2a483894d25e6ef83e3cb8e9b11ad896807fd830bc4e21834fa75babfa3257e42be46bfad837b0eced1945c8a15e47b6d2a864099816

        • memory/472-2-0x0000000000401000-0x00000000004BE000-memory.dmp

          Filesize

          756KB

        • memory/472-8-0x0000000000400000-0x000000000051F000-memory.dmp

          Filesize

          1.1MB

        • memory/472-1384-0x0000000000400000-0x000000000051F000-memory.dmp

          Filesize

          1.1MB

        • memory/472-1-0x0000000000400000-0x000000000051F000-memory.dmp

          Filesize

          1.1MB

        • memory/2144-1324-0x00007FF87989B000-0x00007FF87989C000-memory.dmp

          Filesize

          4KB

        • memory/3552-6-0x0000000000400000-0x0000000000767000-memory.dmp

          Filesize

          3.4MB

        • memory/3552-9-0x0000000000400000-0x0000000000767000-memory.dmp

          Filesize

          3.4MB

        • memory/3552-11-0x00000000026D0000-0x0000000002810000-memory.dmp

          Filesize

          1.2MB

        • memory/3552-15-0x0000000000400000-0x0000000000767000-memory.dmp

          Filesize

          3.4MB

        • memory/3552-772-0x0000000000400000-0x0000000000767000-memory.dmp

          Filesize

          3.4MB

        • memory/3552-1135-0x0000000000400000-0x0000000000767000-memory.dmp

          Filesize

          3.4MB

        • memory/3552-1382-0x0000000000400000-0x0000000000767000-memory.dmp

          Filesize

          3.4MB