Overview

overview

10

Static

static

1

ProtonVPN_...64.exe

windows10-2004-x64

10

ProtonVPN_...64.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/07/2026, 03:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProtonVPN_v4.4.1_x64.exe
  • Size 121.0MB
  • Sample260709-ea2fzsds2x
  • SHA256 b0d9a4330712601fca4219508a12989fdb536779c93040832ff87559fccf4882
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Badlisted process makes network request 6 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 41 IoCs
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3236
      • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5928
        • C:\Users\Admin\AppData\Local\Temp\is-7GQZ664QZ7.tmp\ProtonVPN_v4.4.1_x64.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-7GQZ664QZ7.tmp\ProtonVPN_v4.4.1_x64.tmp" /SL5="$6023C,125577697,1139200,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5112
          • C:\Users\Admin\AppData\Local\Temp\is-KDXLPUZCME.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-KDXLPUZCME.tmp\VC_redist.x64.exe" /install /quiet /norestart
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5028
            • C:\Windows\Temp\{EE50F1EB-61EB-4634-896F-DB5E4E362A38}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{EE50F1EB-61EB-4634-896F-DB5E4E362A38}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-KDXLPUZCME.tmp\VC_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /install /quiet /norestart
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3056
              • C:\Windows\Temp\{A01C651B-1375-40F5-87D4-27ADAF186E30}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{A01C651B-1375-40F5-87D4-27ADAF186E30}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{C9B2641D-9763-428C-970B-222E28BBC80A} {8F3DEA60-4F16-4336-ADAC-4D7C81A0D7EB} 3056
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2680
          • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
            "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3428
            • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
              "v4.4.1\ProtonVPN.Client.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
              5⤵
              • Adds Run key to start application
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies Control Panel
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:5736
      • C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe
        C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe /Mail /Drive /Pass /CreateDesktopShortcut
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4884
        • C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.2.exe
          "C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.2.exe" Source=vpn /quiet NoAppDataCleanup=1 NoAutoLaunch=1
          3⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5224
          • C:\Windows\TEMP\{03D29D79-6BEA-4AC8-9EF1-3B7C3147EE6D}\.ba\wixprqba.exe
            "C:\Windows\TEMP\{03D29D79-6BEA-4AC8-9EF1-3B7C3147EE6D}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{DE2A45A0-DAF5-431B-8597-EBDD185E710A} {DBC8356E-CDCA-499A-AF4C-B30E756526EF}
            4⤵
            • Executes dropped EXE
            PID:4668
          • C:\Windows\TEMP\{03D29D79-6BEA-4AC8-9EF1-3B7C3147EE6D}\.ba\wixiuiba.exe
            "C:\Windows\TEMP\{03D29D79-6BEA-4AC8-9EF1-3B7C3147EE6D}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{DFCB93DB-9A31-4AE7-AA0B-23823AEBCA7A} {0376B4B4-4A47-4D75-849E-029496A6710C}
            4⤵
            • Executes dropped EXE
            PID:5300
        • C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe" --source=vpn --silent=1 --auto-launch=0
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6016
          • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
            "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --source=vpn --silent=1 --auto-launch=0
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:260
            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Squirrel.exe
              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
              5⤵
              • Executes dropped EXE
              PID:3872
            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --squirrel-install 1.13.3 --source="vpn" --desktop-shortcut=1
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:1080
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Proton Mail" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Proton Mail\Crashpad" --url=https://mail-api.proton.me/core/v4/reports/sentry/api/54/minidump/?sentry_key=8c45c7615ac54aed9a6747430e0a5d8e "--annotation=_productName=Proton Mail" --annotation=_version=1.13.3 --annotation=plat=Win64 --annotation=prod=Electron "--annotation=sentry___initialScope={\"release\":\"[email protected]+packaged\",\"environment\":\"proton.me\"}" --annotation=ver=40.10.1 --initial-client-data=0x480,0x478,0x484,0x454,0x49c,0x7ff744af5a0c,0x7ff744af5a18,0x7ff744af5a28
                6⤵
                • Executes dropped EXE
                PID:4152
              • C:\Users\Admin\AppData\Local\proton_mail\Update.exe
                C:\Users\Admin\AppData\Local\proton_mail\Update.exe "--createShortcut=Proton Mail.exe" --shortcut-locations=Desktop,StartMenu
                6⤵
                • Executes dropped EXE
                PID:4524
              • C:\Windows\System32\reg.exe
                C:\Windows\System32\reg.exe import C:\Users\Admin\AppData\Local\Temp\protonmail-mailto-register.reg
                6⤵
                • Modifies registry class
                PID:3300
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,17242500434868097879,10423690054315269879,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1872 /prefetch:2
                6⤵
                • Executes dropped EXE
                PID:3168
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --ignore-certificate-errors --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --enable-sandbox --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1876,i,17242500434868097879,10423690054315269879,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1148 /prefetch:3
                6⤵
                • Executes dropped EXE
                PID:7436
    • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
      "C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe"
      1⤵
      • Executes dropped EXE
      PID:5380
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2056
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5380
    • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
      "C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe"
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5696
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Adds Run key to start application
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5596
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 28A0B0E4511C879179B1C36C3E302724
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4184
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSICDC6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240766515 2 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
          3⤵
          • Drops file in Windows directory
          PID:3036
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSICF0F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240766734 6 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
          3⤵
          • Drops file in Windows directory
          PID:2068
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSICFFA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240766984 11 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.DoPerMachineUpgradeSupportActions
          3⤵
          • Drops file in Windows directory
          PID:2280
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 6AFB326C6AD408B878AB3AAE943F95CE
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5664
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSIEBF.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240783046 36 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
          3⤵
          • Drops file in Windows directory
          PID:1444
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI267E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240789125 40 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
          3⤵
          • Drops file in Windows directory
          PID:5416
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI2922.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240789796 72 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.RemoveStartupEntry
          3⤵
          • Drops file in Windows directory
          PID:2984
    • C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe
      "C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3816
      • C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe
        "C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260709044711.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260709044711.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1
        2⤵
        • Adds Run key to start application
        • Enumerates connected drives
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2156
        • C:\Windows\TEMP\{C99B83FF-E16E-44FE-8122-055F96041B6D}\.ba\wixprqba.exe
          "C:\Windows\TEMP\{C99B83FF-E16E-44FE-8122-055F96041B6D}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{6D32C3AF-B259-4CEC-A2AE-E7054ADBCC35} {0BFE3FB3-6D57-4FCA-92DB-0482710E7558}
          3⤵
          • Executes dropped EXE
          PID:6112
        • C:\Windows\TEMP\{C99B83FF-E16E-44FE-8122-055F96041B6D}\.ba\wixiuiba.exe
          "C:\Windows\TEMP\{C99B83FF-E16E-44FE-8122-055F96041B6D}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{E2DC64B8-DE01-4AB6-82B8-525A10A8E23F} {CC35F060-3B74-4584-B2C9-61E215F70E09}
          3⤵
          • Executes dropped EXE
          PID:5688
    • C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe
      "C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe" -quiet
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5216

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          5
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e598ce7.rbs
          • Path C:\Config.Msi\e598ce7.rbs
          • Size 21KB
          • SHA256 a4e4da875a5a72f862879828cd68b1420a2da5c07e4375312ac316c67c487eb5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e598ceb.rbs
          • Path C:\Config.Msi\e598ceb.rbs
          • Size 3KB
          • SHA256 2bd9dd576029fef042dac893e76f591eb213a43bf1cd932321fcc8d46b464541
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          ProtonVPN.Launcher.exe
          • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
          • Size 17.9MB
          • SHA256 fca85ac5052e62f7aab2b7c199e13df2f2330483134c5926c99f61c9af7586d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CoreMessagingXP.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\CoreMessagingXP.dll
          • Size 1018KB
          • SHA256 2b1d604460a7d44b5e555e9e3068785b96287b034cb120ecc3290fb70260c762
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Internal.FrameworkUdk.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.Internal.FrameworkUdk.dll
          • Size 905KB
          • SHA256 51dc87180623b78bcd4933bfbc40ea7bd42efc25a3e5c2b34a47c850a7d0a805
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.UI.Windowing.Core.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.UI.Windowing.Core.dll
          • Size 530KB
          • SHA256 ca0015abf1533f2f3357c8a6480a6ceb2adda66810f0d5d257da33ef13e3315c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.WinUI.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.WinUI.dll
          • Size 7.0MB
          • SHA256 b745cc38595f48f6b33c02eefc5d5df15a7759ea9e918ce1c18ddf3eb050ce38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.WindowsAppRuntime.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.WindowsAppRuntime.dll
          • Size 2.2MB
          • SHA256 8d593c4374b193b18ba37b8be8cce093ae4f247423c127ee9c09a63ded3dbb64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.ui.xaml.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.ui.xaml.dll
          • Size 14.3MB
          • SHA256 f4084263744c5dd5c37cc7dbd1f6a26ad7acf989e306184359b4377f3435319b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonInstaller.exe
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe
          • Size 6.0MB
          • SHA256 73b8708d5035cfde020747e7e62e34ad6e2b187415fa5e33a951affaf7a624c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Client.deps.json
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.deps.json
          • Size 559KB
          • SHA256 bf0d1e1f2095051668d878f21b2aff740703d068674d126ab35428b8ae4e89ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Client.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.dll
          • Size 3.0MB
          • SHA256 f4fc38ed924833fdd5e00aa6b9fc47165130a1a8f0ca72eb3d2a0247fb39ba06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Client.exe
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
          • Size 589KB
          • SHA256 dd49422f35b76ebcd4d9a60a300b0eb4e427185bfd9fe3ad45320d8a97595742
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Common.Core.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Common.Core.dll
          • Size 66KB
          • SHA256 94143bfae0c009201778ac6164c11089a0f575d6c71e01ba37b34a5839f3d840
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPNService.deps.json
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.deps.json
          • Size 375KB
          • SHA256 3d786b7dcd1ae5099d245f9fa009194cc19432838d63db44f4fb30dbc593ba0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPNService.exe
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
          • Size 466KB
          • SHA256 29cd1f1c9b0f368739f6f7840f641480abeaa3f492a9325edb712dcdfb2016f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPNService.runtimeconfig.json
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.runtimeconfig.json
          • Size 629B
          • SHA256 becb5e7dbe360a21ec893d5fbed565339094204adeb595a83cb2541e0fc99cb9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Sentry.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Sentry.dll
          • Size 786KB
          • SHA256 983e82ccedac76fe39677bef1e93436bf6a696c39b83ec7591f4d472ecf6ccd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.Concurrent.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Collections.Concurrent.dll
          • Size 269KB
          • SHA256 0b1545071db0e5e918035aa7103bf8864d504099c6083bed5db94f8657711d74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Collections.dll
          • Size 253KB
          • SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Linq.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Linq.dll
          • Size 529KB
          • SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Memory.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Memory.dll
          • Size 153KB
          • SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ObjectModel.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.ObjectModel.dll
          • Size 77KB
          • SHA256 62e0cd6e1585a1f5cd153e2832a03b6dafac0e0ab3331048e7f7bd3dd692f9c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.CoreLib.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Private.CoreLib.dll
          • Size 12.6MB
          • SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.CompilerServices.Unsafe.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.CompilerServices.Unsafe.dll
          • Size 14KB
          • SHA256 13978df865f57310a6fd2a68b6b7c8c3add3e7d222335f191998429c65ebd7c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.InteropServices.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.InteropServices.dll
          • Size 93KB
          • SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.dll
          • Size 42KB
          • SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Threading.dll
          • Size 81KB
          • SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WinRT.Runtime.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\WinRT.Runtime.dll
          • Size 516KB
          • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          clrjit.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\clrjit.dll
          • Size 1.7MB
          • SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          coreclr.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\coreclr.dll
          • Size 4.8MB
          • SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostfxr.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\hostfxr.dll
          • Size 357KB
          • SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostpolicy.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\hostpolicy.dll
          • Size 397KB
          • SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-G7H2VN14G9.tmp
          • Path C:\Program Files\Proton\VPN\v4.4.1\is-G7H2VN14G9.tmp
          • Size 245KB
          • SHA256 9f90955a42a154f2efcd564723e9c3be8d68e41185bfa01476d0adac30a40c7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Setup Log 2026-07-09 #001.txt
          • Path C:\Users\Admin\AppData\Local\Temp\Setup Log 2026-07-09 #001.txt
          • Size 417KB
          • SHA256 2fa48b5186b1733da8cc5ecb6e9fd259d4f177fcf87179a6d9eb7cf4e848a67d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN_v4.4.1_x64.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-7GQZ664QZ7.tmp\ProtonVPN_v4.4.1_x64.tmp
          • Size 3.8MB
          • SHA256 94fa0009490e7e57a6bea8bb4d59eed1293e14f1040640af78d059366e7b53f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.InstallActions.x86.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-KDXLPUZCME.tmp\ProtonVPN.InstallActions.x86.dll
          • Size 460KB
          • SHA256 87e106374a5612c02486e19ecca2ae67b482c72f2dac67855040d7cce994b220
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-KDXLPUZCME.tmp\VC_redist.x64.exe
          • Size 17.7MB
          • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          squirrel.exe
          • Path C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\squirrel.exe
          • Size 2.1MB
          • SHA256 578779193ceb774e78b5ff53d41a6b6a247f91b5873dc7424bdc81e85a8059aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Proton Drive.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk
          • Size 1KB
          • SHA256 80359f178f2f50604db2751c889c168cf883f26a37a017f2cdf100643f27902a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Proton Drive.lnk~RFe59dae5.TMP
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk~RFe59dae5.TMP
          • Size 1KB
          • SHA256 be1da0117805208afd47ce6bdcb3f61819e39f88bf95cbda4b4c408f43b4bf77
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\Local Storage\leveldb\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          44d34109-81cc-46e3-901d-873c8be2eb2f.tmp
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\44d34109-81cc-46e3-901d-873c8be2eb2f.tmp
          • Size 93B
          • SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          index
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\Code Cache\wasm\index
          • Size 24B
          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
          • MD5 SHA1 SHA512
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\Local Storage\leveldb\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          config.json
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
          • Size 216B
          • SHA256 8dcd9921dd77d6c4bd9edd3cc1a33f4ab3e1fdee6855106e5f12b219f69f2746
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          config.json
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
          • Size 395B
          • SHA256 91f3c3135315cd455a1aa776865cf6ee903d763c717a458684f70684939dfc25
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          config.json
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
          • Size 456B
          • SHA256 3b70e55408939fd1989c6a961f6480a6fed1eef18a61356c2f604ff0ccbceb81
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          main.log
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
          • Size 2KB
          • SHA256 d4c577e71452eea1ed73a0bcd814a6acfaa96e1c8d885592565c7cfac5fa20a3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          main.log
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
          • Size 3KB
          • SHA256 f5bb83408881dafbb1c030a332f0d27340dfdb1921528c7b71ed315215df79c3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Proton Drive.lnk
          • Path C:\Users\Admin\Desktop\Proton Drive.lnk
          • Size 1KB
          • SHA256 26f73a642c7a604015232d18a648d2d23392fe8284bed51b03188474437adef4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Proton Drive.lnk~RFe59db62.TMP
          • Path C:\Users\Admin\Desktop\Proton Drive.lnk~RFe59db62.TMP
          • Size 1KB
          • SHA256 dd50db839694ec908efa7977ed14c006e90d440c449efba2fac25efc3e14f63d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSICFFA.tmp
          • Path C:\Windows\Installer\MSICFFA.tmp
          • Size 322KB
          • SHA256 667ec687b7137efae7a50880048d4b8db147f297778d5123b63831a1f18844dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSID165.tmp
          • Path C:\Windows\Installer\MSID165.tmp
          • Size 390KB
          • SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CustomAction.config
          • Path C:\Windows\Installer\SFXCAB7EC609AC34AEF188CB76F0246153029\CustomAction.config
          • Size 959B
          • SHA256 7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Proton.Drive.Installer.Extensions.dll
          • Path C:\Windows\Installer\SFXCAB7EC609AC34AEF188CB76F0246153029\Proton.Drive.Installer.Extensions.dll
          • Size 7KB
          • SHA256 94dd29dc1a052004f50aae08e138725537581b6227dced44d6e6ef117cf8fae3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WixToolset.Dtf.WindowsInstaller.dll
          • Path C:\Windows\Installer\SFXCAB7EC609AC34AEF188CB76F0246153029\WixToolset.Dtf.WindowsInstaller.dll
          • Size 193KB
          • SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe
          • Path C:\Windows\Temp\{03D29D79-6BEA-4AC8-9EF1-3B7C3147EE6D}\.be\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe
          • Size 1.3MB
          • SHA256 9fe4a7118e90a1dece7a2b4b71726726a73a181bb78021eb5dde2386e47dbec8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{A01C651B-1375-40F5-87D4-27ADAF186E30}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{A01C651B-1375-40F5-87D4-27ADAF186E30}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Windows\Temp\{EE50F1EB-61EB-4634-896F-DB5E4E362A38}\.cr\VC_redist.x64.exe
          • Size 615KB
          • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/260-2801-0x0000000000AA0000-0x0000000000C78000-memory.dmp
          Download

          memory/3036-2596-0x0000019B28480000-0x0000019B284B4000-memory.dmp
          Download

          memory/3036-2598-0x0000019B28420000-0x0000019B28426000-memory.dmp
          Download

          memory/3872-2904-0x00000000001A0000-0x00000000003BE000-memory.dmp
          Download

          memory/4524-3294-0x0000000000BE0000-0x0000000000C00000-memory.dmp
          Download

          memory/5112-1079-0x0000000000E70000-0x0000000001251000-memory.dmp
          Download

          memory/5112-20-0x0000000001410000-0x0000000001411000-memory.dmp
          Download

          memory/5112-2471-0x0000000000E70000-0x0000000001251000-memory.dmp
          Download

          memory/5112-5-0x0000000001410000-0x0000000001411000-memory.dmp
          Download

          memory/5112-2455-0x0000000000E70000-0x0000000001251000-memory.dmp
          Download

          memory/5112-1140-0x0000000003420000-0x0000000003560000-memory.dmp
          Download

          memory/5112-11-0x0000000003420000-0x0000000003560000-memory.dmp
          Download

          memory/5112-23-0x0000000003420000-0x0000000003560000-memory.dmp
          Download

          memory/5112-22-0x0000000000E70000-0x0000000001251000-memory.dmp
          Download

          memory/5112-19-0x0000000000E70000-0x0000000001251000-memory.dmp
          Download

          memory/5736-2491-0x00007FFDB09B0000-0x00007FFDB09C0000-memory.dmp
          Download

          memory/5736-2526-0x000002A85DF80000-0x000002A85E030000-memory.dmp
          Download

          memory/5928-18-0x0000000000670000-0x0000000000795000-memory.dmp
          Download

          memory/5928-0-0x0000000000670000-0x0000000000795000-memory.dmp
          Download

          memory/5928-2520-0x0000000000670000-0x0000000000795000-memory.dmp
          Download