Overview

overview

10

Static

static

1

ProtonVPN_...64.exe

windows10-2004-x64

10

ProtonVPN_...64.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/07/2026, 10:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProtonVPN_v4.4.1_x64.exe
  • Size 121.0MB
  • Sample260715-mcbbksds2w
  • SHA256 b0d9a4330712601fca4219508a12989fdb536779c93040832ff87559fccf4882
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Reads ssh keys stored on the system 2 TTPs

    Tries to access SSH used by SSH programs.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 24 IoCs
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3216
      • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2708
        • C:\Users\Admin\AppData\Local\Temp\is-CVG9N5OS5J.tmp\ProtonVPN_v4.4.1_x64.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-CVG9N5OS5J.tmp\ProtonVPN_v4.4.1_x64.tmp" /SL5="$4025A,125577697,1139200,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4788
          • C:\Users\Admin\AppData\Local\Temp\is-CADXRB0IFI.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-CADXRB0IFI.tmp\VC_redist.x64.exe" /install /quiet /norestart
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2644
            • C:\Windows\Temp\{84C0BF2A-29AD-4A9B-A7B4-493D48ACF1E6}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{84C0BF2A-29AD-4A9B-A7B4-493D48ACF1E6}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-CADXRB0IFI.tmp\VC_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=692 /install /quiet /norestart
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1124
              • C:\Windows\Temp\{22CF0539-45E6-4353-94F8-7B6D1388FE61}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{22CF0539-45E6-4353-94F8-7B6D1388FE61}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E1F4AE27-A85E-464E-B5B9-E51E169787ED} {3F40817A-A06E-4A61-9BEB-C4C7CF252CB5} 1124
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2304
          • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
            "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4728
            • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
              "v4.4.1\ProtonVPN.Client.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
              5⤵
              • Adds Run key to start application
              • Checks computer location settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies Control Panel
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:3388
      • C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe
        C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe /Mail /Drive /Pass /CreateDesktopShortcut
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:556
        • C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.2.exe
          "C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.2.exe" Source=vpn /quiet NoAppDataCleanup=1 NoAutoLaunch=1
          3⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3328
          • C:\Windows\TEMP\{ADE23D60-8C19-43C0-BC64-C0CE2D4BBC9C}\.ba\wixprqba.exe
            "C:\Windows\TEMP\{ADE23D60-8C19-43C0-BC64-C0CE2D4BBC9C}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{E74DD733-AA2B-4FB6-B89A-EFADFAC55452} {3A04BB7F-20A0-43B3-9B61-B30DF3316644}
            4⤵
            • Executes dropped EXE
            PID:3340
          • C:\Windows\TEMP\{ADE23D60-8C19-43C0-BC64-C0CE2D4BBC9C}\.ba\wixiuiba.exe
            "C:\Windows\TEMP\{ADE23D60-8C19-43C0-BC64-C0CE2D4BBC9C}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{4C616C88-3916-47C1-A67E-ACFBACF12718} {D2F0D5BB-0120-40D9-B808-184ACFF48AC5}
            4⤵
            • Executes dropped EXE
            PID:4068
        • C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe" --source=vpn --silent=1 --auto-launch=0
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3768
          • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
            "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --source=vpn --silent=1 --auto-launch=0
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3908
            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Squirrel.exe
              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
              5⤵
              • Executes dropped EXE
              PID:3080
            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --squirrel-install 1.13.3 --source="vpn" --desktop-shortcut=1
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:1192
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Proton Mail" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Proton Mail\Crashpad" --url=https://mail-api.proton.me/core/v4/reports/sentry/api/54/minidump/?sentry_key=8c45c7615ac54aed9a6747430e0a5d8e "--annotation=_productName=Proton Mail" --annotation=_version=1.13.3 --annotation=plat=Win64 --annotation=prod=Electron "--annotation=sentry___initialScope={\"release\":\"[email protected]+packaged\",\"environment\":\"proton.me\"}" --annotation=ver=40.10.1 --initial-client-data=0x47c,0x478,0x480,0x454,0x484,0x7ff6b3515a0c,0x7ff6b3515a18,0x7ff6b3515a28
                6⤵
                • Executes dropped EXE
                PID:1676
              • C:\Users\Admin\AppData\Local\proton_mail\Update.exe
                C:\Users\Admin\AppData\Local\proton_mail\Update.exe "--createShortcut=Proton Mail.exe" --shortcut-locations=Desktop,StartMenu
                6⤵
                • Executes dropped EXE
                PID:1512
              • C:\Windows\System32\reg.exe
                C:\Windows\System32\reg.exe import C:\Users\Admin\AppData\Local\Temp\protonmail-mailto-register.reg
                6⤵
                • Modifies registry class
                PID:544
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,5725073518520988943,12558090254386390812,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1844 /prefetch:2
                6⤵
                • Executes dropped EXE
                PID:1840
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1848,i,5725073518520988943,12558090254386390812,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2312 /prefetch:3
                6⤵
                • Executes dropped EXE
                PID:744
    • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
      "C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe"
      1⤵
      • Executes dropped EXE
      PID:1072
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2852
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2176
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Adds Run key to start application
      • Badlisted process makes network request
      • Enumerates connected drives
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 43FC96D8AC7A74C6037EC4220C5C1492
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI7BFC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240745531 2 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
          3⤵
          • Drops file in Windows directory
          PID:2344
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI7D45.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240745812 6 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
          3⤵
          • Drops file in Windows directory
          PID:1884
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI7F0C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240746328 11 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.DoPerMachineUpgradeSupportActions
          3⤵
          • Drops file in Windows directory
          PID:5064
    • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
      "C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe"
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3960
    • C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe
      "C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:812
      • C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe
        "C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260715062856.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260715062856.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1
        2⤵
        • Adds Run key to start application
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4360
        • C:\Windows\TEMP\{381B434B-2529-4209-A618-DD0F9733701E}\.ba\wixprqba.exe
          "C:\Windows\TEMP\{381B434B-2529-4209-A618-DD0F9733701E}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{AC3C9B85-6294-493C-B6D3-19FD861EAFD6} {C46D6867-83E0-4E9B-A6D9-84497C449F5B}
          3⤵
          • Executes dropped EXE
          PID:3532
        • C:\Windows\TEMP\{381B434B-2529-4209-A618-DD0F9733701E}\.ba\wixiuiba.exe
          "C:\Windows\TEMP\{381B434B-2529-4209-A618-DD0F9733701E}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9824014D-AAED-4D05-8041-F626D84369BB} {9FB89340-FF52-4CFD-A5E9-F91F3111289B}
          3⤵
          • Executes dropped EXE
          PID:1604
    • C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe
      "C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe" -quiet
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2032

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          1
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          5
          T1012

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e597383.rbs
          • Path C:\Config.Msi\e597383.rbs
          • Size 21KB
          • SHA256 24cc7b0a8a9c2846b6f42b780425c75953368a997c828c74084cc8f8cca95d73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Launcher.exe
          • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
          • Size 17.9MB
          • SHA256 fca85ac5052e62f7aab2b7c199e13df2f2330483134c5926c99f61c9af7586d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CoreMessagingXP.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\CoreMessagingXP.dll
          • Size 1018KB
          • SHA256 2b1d604460a7d44b5e555e9e3068785b96287b034cb120ecc3290fb70260c762
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Internal.FrameworkUdk.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.Internal.FrameworkUdk.dll
          • Size 905KB
          • SHA256 51dc87180623b78bcd4933bfbc40ea7bd42efc25a3e5c2b34a47c850a7d0a805
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.UI.Windowing.Core.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.UI.Windowing.Core.dll
          • Size 530KB
          • SHA256 ca0015abf1533f2f3357c8a6480a6ceb2adda66810f0d5d257da33ef13e3315c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.WinUI.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.WinUI.dll
          • Size 7.0MB
          • SHA256 b745cc38595f48f6b33c02eefc5d5df15a7759ea9e918ce1c18ddf3eb050ce38
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.WindowsAppRuntime.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.WindowsAppRuntime.dll
          • Size 2.2MB
          • SHA256 8d593c4374b193b18ba37b8be8cce093ae4f247423c127ee9c09a63ded3dbb64
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.ui.xaml.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.ui.xaml.dll
          • Size 14.3MB
          • SHA256 f4084263744c5dd5c37cc7dbd1f6a26ad7acf989e306184359b4377f3435319b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonInstaller.exe
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe
          • Size 6.0MB
          • SHA256 73b8708d5035cfde020747e7e62e34ad6e2b187415fa5e33a951affaf7a624c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Client.deps.json
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.deps.json
          • Size 559KB
          • SHA256 bf0d1e1f2095051668d878f21b2aff740703d068674d126ab35428b8ae4e89ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Client.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.dll
          • Size 3.0MB
          • SHA256 f4fc38ed924833fdd5e00aa6b9fc47165130a1a8f0ca72eb3d2a0247fb39ba06
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Client.exe
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
          • Size 589KB
          • SHA256 dd49422f35b76ebcd4d9a60a300b0eb4e427185bfd9fe3ad45320d8a97595742
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.Common.Core.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Common.Core.dll
          • Size 66KB
          • SHA256 94143bfae0c009201778ac6164c11089a0f575d6c71e01ba37b34a5839f3d840
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPNService.deps.json
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.deps.json
          • Size 375KB
          • SHA256 3d786b7dcd1ae5099d245f9fa009194cc19432838d63db44f4fb30dbc593ba0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPNService.exe
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
          • Size 466KB
          • SHA256 29cd1f1c9b0f368739f6f7840f641480abeaa3f492a9325edb712dcdfb2016f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPNService.runtimeconfig.json
          • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.runtimeconfig.json
          • Size 629B
          • SHA256 becb5e7dbe360a21ec893d5fbed565339094204adeb595a83cb2541e0fc99cb9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Sentry.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\Sentry.dll
          • Size 786KB
          • SHA256 983e82ccedac76fe39677bef1e93436bf6a696c39b83ec7591f4d472ecf6ccd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.Concurrent.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Collections.Concurrent.dll
          • Size 269KB
          • SHA256 0b1545071db0e5e918035aa7103bf8864d504099c6083bed5db94f8657711d74
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Collections.dll
          • Size 253KB
          • SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Linq.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Linq.dll
          • Size 529KB
          • SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Memory.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Memory.dll
          • Size 153KB
          • SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ObjectModel.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.ObjectModel.dll
          • Size 77KB
          • SHA256 62e0cd6e1585a1f5cd153e2832a03b6dafac0e0ab3331048e7f7bd3dd692f9c4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.CoreLib.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Private.CoreLib.dll
          • Size 12.6MB
          • SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.CompilerServices.Unsafe.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.CompilerServices.Unsafe.dll
          • Size 14KB
          • SHA256 13978df865f57310a6fd2a68b6b7c8c3add3e7d222335f191998429c65ebd7c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.InteropServices.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.InteropServices.dll
          • Size 93KB
          • SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.dll
          • Size 42KB
          • SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\System.Threading.dll
          • Size 81KB
          • SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WinRT.Runtime.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\WinRT.Runtime.dll
          • Size 516KB
          • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          clrjit.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\clrjit.dll
          • Size 1.7MB
          • SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          coreclr.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\coreclr.dll
          • Size 4.8MB
          • SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostfxr.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\hostfxr.dll
          • Size 357KB
          • SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostpolicy.dll
          • Path C:\Program Files\Proton\VPN\v4.4.1\hostpolicy.dll
          • Size 397KB
          • SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          is-MHS7CBG0FG.tmp
          • Path C:\Program Files\Proton\VPN\v4.4.1\is-MHS7CBG0FG.tmp
          • Size 245KB
          • SHA256 9f90955a42a154f2efcd564723e9c3be8d68e41185bfa01476d0adac30a40c7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Proton_Drive_20260715062856_000_Proton_Drive_Setup_3.0.2__e09b2de5___x64_.msi.log
          • Path C:\Users\Admin\AppData\Local\Proton\Proton Drive\Logs\Installation\Proton_Drive_20260715062856_000_Proton_Drive_Setup_3.0.2__e09b2de5___x64_.msi.log
          • Size 226KB
          • SHA256 1a7d8d27436952f3e1b906c0dcb54dfb1f46a1a93c01029a28e51377d8146158
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Setup Log 2026-07-15 #001.txt
          • Path C:\Users\Admin\AppData\Local\Temp\Setup Log 2026-07-15 #001.txt
          • Size 417KB
          • SHA256 54da60f3a1269aad837530d3f4f2f62a0b858973ef8cba56c1d4cf7055d6a7a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN.InstallActions.x86.dll
          • Path C:\Users\Admin\AppData\Local\Temp\is-CADXRB0IFI.tmp\ProtonVPN.InstallActions.x86.dll
          • Size 460KB
          • SHA256 87e106374a5612c02486e19ecca2ae67b482c72f2dac67855040d7cce994b220
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\is-CADXRB0IFI.tmp\VC_redist.x64.exe
          • Size 17.7MB
          • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ProtonVPN_v4.4.1_x64.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\is-CVG9N5OS5J.tmp\ProtonVPN_v4.4.1_x64.tmp
          • Size 3.8MB
          • SHA256 94fa0009490e7e57a6bea8bb4d59eed1293e14f1040640af78d059366e7b53f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          squirrel.exe
          • Path C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\squirrel.exe
          • Size 2.1MB
          • SHA256 578779193ceb774e78b5ff53d41a6b6a247f91b5873dc7424bdc81e85a8059aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          default.dic
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          Proton Drive.lnk
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk
          • Size 1KB
          • SHA256 1ccd12a958c01a559c10404223f868df4ad1e09677de11252c3a4a4d6d1d48c9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Proton Drive.lnk~RFe598bac.TMP
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk~RFe598bac.TMP
          • Size 1KB
          • SHA256 a2730294a9c59d83dc6d9f052411f8e479ff2d385e82d80e6584ad9494030ea2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          temp-index
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Code Cache\wasm\index-dir\temp-index
          • Size 48B
          • SHA256 4408de490654f507befc88305163875a876142f56f6b6fedf56437eea7b721d5
          • MD5 SHA1 SHA512
          Submit Download

          15e0e3a1-0085-452c-a25d-a4ed29b74a7f.tmp
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Network\15e0e3a1-0085-452c-a25d-a4ed29b74a7f.tmp
          • Size 111B
          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          index
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\Code Cache\wasm\index
          • Size 24B
          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
          • MD5 SHA1 SHA512
          Submit Download

          CURRENT
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\Local Storage\leveldb\CURRENT
          • Size 16B
          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
          • MD5 SHA1 SHA512
          Submit Download

          MANIFEST-000001
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\Local Storage\leveldb\MANIFEST-000001
          • Size 41B
          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
          • MD5 SHA1 SHA512
          Submit Download

          febce0f9-1474-4e66-ac20-375fcf1d9f56.tmp
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\febce0f9-1474-4e66-ac20-375fcf1d9f56.tmp
          • Size 93B
          • SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          config.json
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
          • Size 216B
          • SHA256 1375da75349eb6a007e292fad549640db900620a3cb9f126534438017d85e848
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          config.json
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
          • Size 395B
          • SHA256 e0d82c6b4d4721f7ed419078f28d18534065779825a29f7708e6a60236c30388
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          config.json
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
          • Size 456B
          • SHA256 4c8bd6608c7299bfe4408534a4d9377d1f9f8e3eede83d8d0def5071e4f977e5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          main.log
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
          • Size 2KB
          • SHA256 c3034438bbfd0f5de3161be5d9987c8b82b54c48d49124bf2bad58a20e1d6d0d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          main.log
          • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
          • Size 3KB
          • SHA256 0f3b4fbd04f643332d3690d7bd96b8f21eb27dc269a855603c0000b1b92b3139
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Proton Drive.lnk
          • Path C:\Users\Admin\Desktop\Proton Drive.lnk
          • Size 1KB
          • SHA256 fbdf20808cbd79eb4ee070a551746918247528e9fc582d90d7850518f83500c4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Proton Drive.lnk~RFe598c58.TMP
          • Path C:\Users\Admin\Desktop\Proton Drive.lnk~RFe598c58.TMP
          • Size 1KB
          • SHA256 902a2f3ae3b81058180ada962e6642adddb2ab0a5a8b58c296216f70c7ca09e4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI7F0C.tmp
          • Path C:\Windows\Installer\MSI7F0C.tmp
          • Size 322KB
          • SHA256 667ec687b7137efae7a50880048d4b8db147f297778d5123b63831a1f18844dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI80A5.tmp
          • Path C:\Windows\Installer\MSI80A5.tmp
          • Size 390KB
          • SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CustomAction.config
          • Path C:\Windows\Installer\SFXCAB2CB51676348ED2B7C0E269B29AAEFCA\CustomAction.config
          • Size 959B
          • SHA256 7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Proton.Drive.Installer.Extensions.dll
          • Path C:\Windows\Installer\SFXCAB2CB51676348ED2B7C0E269B29AAEFCA\Proton.Drive.Installer.Extensions.dll
          • Size 7KB
          • SHA256 94dd29dc1a052004f50aae08e138725537581b6227dced44d6e6ef117cf8fae3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WixToolset.Dtf.WindowsInstaller.dll
          • Path C:\Windows\Installer\SFXCAB2CB51676348ED2B7C0E269B29AAEFCA\WixToolset.Dtf.WindowsInstaller.dll
          • Size 193KB
          • SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{22CF0539-45E6-4353-94F8-7B6D1388FE61}\.ba\logo.png
          • Size 1KB
          • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.dll
          • Path C:\Windows\Temp\{22CF0539-45E6-4353-94F8-7B6D1388FE61}\.ba\wixstdba.dll
          • Size 215KB
          • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VC_redist.x64.exe
          • Path C:\Windows\Temp\{84C0BF2A-29AD-4A9B-A7B4-493D48ACF1E6}\.cr\VC_redist.x64.exe
          • Size 615KB
          • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe
          • Path C:\Windows\Temp\{ADE23D60-8C19-43C0-BC64-C0CE2D4BBC9C}\.be\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe
          • Size 1.3MB
          • SHA256 9fe4a7118e90a1dece7a2b4b71726726a73a181bb78021eb5dde2386e47dbec8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1512-2873-0x000000001B9E0000-0x000000001BA00000-memory.dmp
          Download

          memory/2344-2590-0x000001A67D550000-0x000001A67D584000-memory.dmp
          Download

          memory/2344-2592-0x000001A67D4B0000-0x000001A67D4B6000-memory.dmp
          Download

          memory/2708-18-0x0000000000890000-0x00000000009B5000-memory.dmp
          Download

          memory/2708-2519-0x0000000000890000-0x00000000009B5000-memory.dmp
          Download

          memory/2708-0-0x0000000000890000-0x00000000009B5000-memory.dmp
          Download

          memory/3080-2834-0x0000000000300000-0x000000000051E000-memory.dmp
          Download

          memory/3388-2701-0x000002C90DA00000-0x000002C90DAB0000-memory.dmp
          Download

          memory/3388-2491-0x00007FFC314E0000-0x00007FFC314F0000-memory.dmp
          Download

          memory/3908-2732-0x00000000005A0000-0x0000000000778000-memory.dmp
          Download

          memory/4788-2452-0x0000000000E40000-0x0000000001221000-memory.dmp
          Download

          memory/4788-1214-0x0000000003D50000-0x0000000003E90000-memory.dmp
          Download

          memory/4788-1135-0x0000000000E40000-0x0000000001221000-memory.dmp
          Download

          memory/4788-23-0x0000000003D50000-0x0000000003E90000-memory.dmp
          Download

          memory/4788-22-0x0000000000E40000-0x0000000001221000-memory.dmp
          Download

          memory/4788-19-0x0000000000E40000-0x0000000001221000-memory.dmp
          Download

          memory/4788-20-0x0000000001AB0000-0x0000000001AB1000-memory.dmp
          Download

          memory/4788-2471-0x0000000000E40000-0x0000000001221000-memory.dmp
          Download

          memory/4788-11-0x0000000003D50000-0x0000000003E90000-memory.dmp
          Download

          memory/4788-5-0x0000000001AB0000-0x0000000001AB1000-memory.dmp
          Download