Overview

overview

10

Static

static

1

ProtonVPN_...64.exe

windows10-2004-x64

10

ProtonVPN_...64.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    136s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 10:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProtonVPN_v4.4.1_x64.exe
  • Size 121.0MB
  • Sample260715-mcbbksds2w
  • SHA256 b0d9a4330712601fca4219508a12989fdb536779c93040832ff87559fccf4882
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryinstallerpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 48 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:5880
      • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Users\Admin\AppData\Local\Temp\is-9MLGICEO72.tmp\ProtonVPN_v4.4.1_x64.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-9MLGICEO72.tmp\ProtonVPN_v4.4.1_x64.tmp" /SL5="$301E4,125577697,1139200,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v4.4.1_x64.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1828
          • C:\Users\Admin\AppData\Local\Temp\is-7Y6FH2F8CO.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-7Y6FH2F8CO.tmp\VC_redist.x64.exe" /install /quiet /norestart
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4220
            • C:\Windows\Temp\{B9F4BB49-A06D-4C69-B287-4C5C86D64438}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{B9F4BB49-A06D-4C69-B287-4C5C86D64438}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-7Y6FH2F8CO.tmp\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1492
              • C:\Windows\Temp\{5FC1DA96-96F1-4BC7-BF17-4CEA8B1341D5}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{5FC1DA96-96F1-4BC7-BF17-4CEA8B1341D5}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{08F4E218-A5F1-4C87-A2CC-B003B4AD2100} {49865727-BEEB-4BEB-A345-E3FF1A1779DD} 1492
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1228
          • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
            "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2456
            • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
              "v4.4.1\ProtonVPN.Client.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
              5⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies Control Panel
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:5612
      • C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe
        C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe /Mail /Drive /Pass /CreateDesktopShortcut
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5512
        • C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.2.exe
          "C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.2.exe" Source=vpn /quiet NoAppDataCleanup=1 NoAutoLaunch=1
          3⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Windows\TEMP\{182DC5A5-4691-4B47-8AD2-644E68D4A67D}\.ba\wixprqba.exe
            "C:\Windows\TEMP\{182DC5A5-4691-4B47-8AD2-644E68D4A67D}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{D3319232-3B38-4E4D-A051-BB776E00A1CC} {9EEB364E-D852-4655-8487-D4E8F16B6342}
            4⤵
            • Executes dropped EXE
            PID:4764
          • C:\Windows\TEMP\{182DC5A5-4691-4B47-8AD2-644E68D4A67D}\.ba\wixiuiba.exe
            "C:\Windows\TEMP\{182DC5A5-4691-4B47-8AD2-644E68D4A67D}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{6C7E9288-5174-47CE-9F34-94745EEE67E6} {FC309C3C-A0FE-4CA0-A731-E48DF09E1630}
            4⤵
            • Executes dropped EXE
            PID:3868
        • C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe" --source=vpn --silent=1 --auto-launch=0
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:916
          • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
            "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --source=vpn --silent=1 --auto-launch=0
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1228
            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Squirrel.exe
              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
              5⤵
              • Executes dropped EXE
              PID:1276
            • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
              "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --squirrel-install 1.13.3 --source="vpn" --desktop-shortcut=1
              5⤵
              • Executes dropped EXE
              PID:5212
              • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Proton Mail" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Proton Mail\Crashpad" --url=https://mail-api.proton.me/core/v4/reports/sentry/api/54/minidump/?sentry_key=8c45c7615ac54aed9a6747430e0a5d8e "--annotation=_productName=Proton Mail" --annotation=_version=1.13.3 --annotation=plat=Win64 --annotation=prod=Electron "--annotation=sentry___initialScope={\"release\":\"[email protected]+packaged\",\"environment\":\"proton.me\"}" --annotation=ver=40.10.1 --initial-client-data=0x4c4,0x4c8,0x4cc,0x4c0,0x4d0,0x7ff72db75a0c,0x7ff72db75a18,0x7ff72db75a28
                6⤵
                  PID:3516
                • C:\Users\Admin\AppData\Local\proton_mail\Update.exe
                  C:\Users\Admin\AppData\Local\proton_mail\Update.exe "--createShortcut=Proton Mail.exe" --shortcut-locations=Desktop,StartMenu
                  6⤵
                    PID:5092
                  • C:\Windows\System32\reg.exe
                    C:\Windows\System32\reg.exe import C:\Users\Admin\AppData\Local\Temp\protonmail-mailto-register.reg
                    6⤵
                      PID:2676
                    • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                      "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,5365090325622434529,13054613175261138542,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1844 /prefetch:2
                      6⤵
                        PID:5960
                      • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe
                        "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\Proton Mail.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Proton Mail" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1848,i,5365090325622434529,13054613175261138542,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2164 /prefetch:11
                        6⤵
                          PID:696
              • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
                "C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe"
                1⤵
                • Executes dropped EXE
                PID:1424
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Checks SCSI registry key(s)
                • Suspicious use of AdjustPrivilegeToken
                PID:2344
              • C:\Windows\system32\srtasks.exe
                C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3588
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k GPSvcGroup
                1⤵
                  PID:5156
                • C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
                  "C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe"
                  1⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3432
                • C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe
                  "C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe" /burn.runonce
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1672
                  • C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe
                    "C:\Users\Admin\AppData\Local\Package Cache\{F474C3D7-EBC5-4C24-A379-62A5CD9B2C44}\Proton Drive Setup 3.0.2 (e09b2de5) (x64).exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260715062903.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260715062903.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1
                    2⤵
                    • Adds Run key to start application
                    • Enumerates connected drives
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3320
                    • C:\Windows\TEMP\{9E6BCE62-6F81-4606-B01E-F4E865CBDB18}\.ba\wixprqba.exe
                      "C:\Windows\TEMP\{9E6BCE62-6F81-4606-B01E-F4E865CBDB18}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{63EC11B5-4D60-4F9E-967B-69C5A84D234C} {9323972D-63B4-4605-A84F-F6FAABF9C149}
                      3⤵
                      • Executes dropped EXE
                      PID:3464
                    • C:\Windows\TEMP\{9E6BCE62-6F81-4606-B01E-F4E865CBDB18}\.ba\wixiuiba.exe
                      "C:\Windows\TEMP\{9E6BCE62-6F81-4606-B01E-F4E865CBDB18}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9E266353-1E14-402F-BCE6-101C1FA5D3A9} {89FBA3B2-8716-461B-807D-1A2B68881772}
                      3⤵
                      • Executes dropped EXE
                      PID:5920
                • C:\Windows\system32\msiexec.exe
                  C:\Windows\system32\msiexec.exe /V
                  1⤵
                  • Adds Run key to start application
                  • Badlisted process makes network request
                  • Enumerates connected drives
                  • Drops file in Windows directory
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:5524
                  • C:\Windows\System32\MsiExec.exe
                    C:\Windows\System32\MsiExec.exe -Embedding 1AA23251ACE01B6E3DADCB459C2DEF50
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:468
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Windows\Installer\MSI4F1B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240799687 2 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
                      3⤵
                      • Drops file in Windows directory
                      PID:4284
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Windows\Installer\MSI5101.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240800031 6 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
                      3⤵
                      • Drops file in Windows directory
                      PID:4560
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Windows\Installer\MSI51AD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240800203 11 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.DoPerMachineUpgradeSupportActions
                      3⤵
                      • Drops file in Windows directory
                      PID:3348
                  • C:\Windows\System32\MsiExec.exe
                    C:\Windows\System32\MsiExec.exe -Embedding 8A1C390552D508CCC44B471FF389CD4B
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:5808
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Windows\Installer\MSI6A7B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240806671 36 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
                      3⤵
                      • Drops file in Windows directory
                      PID:1540
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Windows\Installer\MSI6BB5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240806906 40 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
                      3⤵
                      • Drops file in Windows directory
                      PID:5124
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Windows\Installer\MSI6EF5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240807703 62 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.RemoveStartupEntry
                      3⤵
                      • Drops file in Windows directory
                      PID:3812
                • C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe
                  "C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe" -quiet
                  1⤵
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:5532

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      e5a45e7.rbs
                      • Path C:\Config.Msi\e5a45e7.rbs
                      • Size 21KB
                      • SHA256 4e0497a9db7e01b9a62b9a31eff0c5d2b72f11133810fb3ddc79fc7ae8569386
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      e5a45eb.rbs
                      • Path C:\Config.Msi\e5a45eb.rbs
                      • Size 3KB
                      • SHA256 d28f846b1f9d483b482af9ed8aba3594a059e470a347476d367bdded0c0b55fd
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      ProtonVPN.Launcher.exe
                      • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
                      • Size 17.9MB
                      • SHA256 fca85ac5052e62f7aab2b7c199e13df2f2330483134c5926c99f61c9af7586d6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CoreMessagingXP.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\CoreMessagingXP.dll
                      • Size 1018KB
                      • SHA256 2b1d604460a7d44b5e555e9e3068785b96287b034cb120ecc3290fb70260c762
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.Internal.FrameworkUdk.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.Internal.FrameworkUdk.dll
                      • Size 905KB
                      • SHA256 51dc87180623b78bcd4933bfbc40ea7bd42efc25a3e5c2b34a47c850a7d0a805
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.UI.Windowing.Core.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.UI.Windowing.Core.dll
                      • Size 530KB
                      • SHA256 ca0015abf1533f2f3357c8a6480a6ceb2adda66810f0d5d257da33ef13e3315c
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.UI.Xaml.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.UI.Xaml.dll
                      • Size 14.3MB
                      • SHA256 f4084263744c5dd5c37cc7dbd1f6a26ad7acf989e306184359b4377f3435319b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.WinUI.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.WinUI.dll
                      • Size 7.0MB
                      • SHA256 b745cc38595f48f6b33c02eefc5d5df15a7759ea9e918ce1c18ddf3eb050ce38
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Microsoft.WindowsAppRuntime.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\Microsoft.WindowsAppRuntime.dll
                      • Size 2.2MB
                      • SHA256 8d593c4374b193b18ba37b8be8cce093ae4f247423c127ee9c09a63ded3dbb64
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ProtonInstaller.exe
                      • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonInstaller.exe
                      • Size 6.0MB
                      • SHA256 73b8708d5035cfde020747e7e62e34ad6e2b187415fa5e33a951affaf7a624c9
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ProtonVPN.Client.deps.json
                      • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.deps.json
                      • Size 559KB
                      • SHA256 bf0d1e1f2095051668d878f21b2aff740703d068674d126ab35428b8ae4e89ad
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ProtonVPN.Client.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.dll
                      • Size 3.0MB
                      • SHA256 f4fc38ed924833fdd5e00aa6b9fc47165130a1a8f0ca72eb3d2a0247fb39ba06
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ProtonVPN.Client.exe
                      • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Client.exe
                      • Size 589KB
                      • SHA256 dd49422f35b76ebcd4d9a60a300b0eb4e427185bfd9fe3ad45320d8a97595742
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ProtonVPN.Common.Core.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPN.Common.Core.dll
                      • Size 66KB
                      • SHA256 94143bfae0c009201778ac6164c11089a0f575d6c71e01ba37b34a5839f3d840
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ProtonVPNService.deps.json
                      • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.deps.json
                      • Size 375KB
                      • SHA256 3d786b7dcd1ae5099d245f9fa009194cc19432838d63db44f4fb30dbc593ba0f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ProtonVPNService.exe
                      • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.exe
                      • Size 466KB
                      • SHA256 29cd1f1c9b0f368739f6f7840f641480abeaa3f492a9325edb712dcdfb2016f0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ProtonVPNService.runtimeconfig.json
                      • Path C:\Program Files\Proton\VPN\v4.4.1\ProtonVPNService.runtimeconfig.json
                      • Size 629B
                      • SHA256 becb5e7dbe360a21ec893d5fbed565339094204adeb595a83cb2541e0fc99cb9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Sentry.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\Sentry.dll
                      • Size 786KB
                      • SHA256 983e82ccedac76fe39677bef1e93436bf6a696c39b83ec7591f4d472ecf6ccd0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      System.Collections.Concurrent.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\System.Collections.Concurrent.dll
                      • Size 269KB
                      • SHA256 0b1545071db0e5e918035aa7103bf8864d504099c6083bed5db94f8657711d74
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      System.Collections.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\System.Collections.dll
                      • Size 253KB
                      • SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      System.Linq.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\System.Linq.dll
                      • Size 529KB
                      • SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      System.Memory.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\System.Memory.dll
                      • Size 153KB
                      • SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      System.Private.CoreLib.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\System.Private.CoreLib.dll
                      • Size 12.6MB
                      • SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      System.Runtime.CompilerServices.Unsafe.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.CompilerServices.Unsafe.dll
                      • Size 14KB
                      • SHA256 13978df865f57310a6fd2a68b6b7c8c3add3e7d222335f191998429c65ebd7c7
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      System.Runtime.InteropServices.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.InteropServices.dll
                      • Size 93KB
                      • SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      System.Runtime.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\System.Runtime.dll
                      • Size 42KB
                      • SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      System.Threading.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\System.Threading.dll
                      • Size 81KB
                      • SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WinRT.Runtime.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\WinRT.Runtime.dll
                      • Size 516KB
                      • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      clrjit.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\clrjit.dll
                      • Size 1.7MB
                      • SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      coreclr.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\coreclr.dll
                      • Size 4.8MB
                      • SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      hostfxr.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\hostfxr.dll
                      • Size 357KB
                      • SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      hostpolicy.dll
                      • Path C:\Program Files\Proton\VPN\v4.4.1\hostpolicy.dll
                      • Size 397KB
                      • SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      is-0FTM506YQA.tmp
                      • Path C:\Program Files\Proton\VPN\v4.4.1\is-0FTM506YQA.tmp
                      • Size 245KB
                      • SHA256 9f90955a42a154f2efcd564723e9c3be8d68e41185bfa01476d0adac30a40c7e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ProtonVPN.InstallActions.x86.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\is-7Y6FH2F8CO.tmp\ProtonVPN.InstallActions.x86.dll
                      • Size 460KB
                      • SHA256 87e106374a5612c02486e19ecca2ae67b482c72f2dac67855040d7cce994b220
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VC_redist.x64.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\is-7Y6FH2F8CO.tmp\VC_redist.x64.exe
                      • Size 17.7MB
                      • SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      ProtonVPN_v4.4.1_x64.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\is-9MLGICEO72.tmp\ProtonVPN_v4.4.1_x64.tmp
                      • Size 3.8MB
                      • SHA256 94fa0009490e7e57a6bea8bb4d59eed1293e14f1040640af78d059366e7b53f3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      squirrel.exe
                      • Path C:\Users\Admin\AppData\Local\proton_mail\app-1.13.3\squirrel.exe
                      • Size 2.1MB
                      • SHA256 578779193ceb774e78b5ff53d41a6b6a247f91b5873dc7424bdc81e85a8059aa
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      default.exc
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                      • Size 2B
                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                      • MD5 SHA1 SHA512
                      Submit Download

                      Proton Drive.lnk
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk
                      • Size 1KB
                      • SHA256 03dc3125ea18598ba02e01f591d93a23f79e0d26a742f63076f47ac70080e045
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Proton Drive.lnk~RFe5a641a.TMP
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk~RFe5a641a.TMP
                      • Size 1KB
                      • SHA256 7dff35d173777abe389d51ba77f0ac831e830623008ed3b62423ab6abbf5281e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      22799314-44e3-4b49-8616-0a8e832afeef.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Network\22799314-44e3-4b49-8616-0a8e832afeef.tmp
                      • Size 111B
                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      99f21e44-a23d-4cc3-a5f9-e56ec50e98f8.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\99f21e44-a23d-4cc3-a5f9-e56ec50e98f8.tmp
                      • Size 93B
                      • SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      CURRENT
                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\app\Local Storage\leveldb\CURRENT
                      • Size 16B
                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                      • MD5 SHA1 SHA512
                      Submit Download

                      index
                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\Code Cache\js\index
                      • Size 24B
                      • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                      • MD5 SHA1 SHA512
                      Submit Download

                      MANIFEST-000001
                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\Partitions\update\Local Storage\leveldb\MANIFEST-000001
                      • Size 41B
                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                      • MD5 SHA1 SHA512
                      Submit Download

                      config.json
                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
                      • Size 216B
                      • SHA256 1f7e887d92c3a77c9b192fc4a4c4f0714be44f7501dd9f15e39a445912f2d4b1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      config.json
                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
                      • Size 456B
                      • SHA256 270e69dab6ec41fc260a1dc19611d9bcf93ee87345f6db0c4af76d29b772e35b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      config.json.tmp-4111404839cd635d
                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json.tmp-4111404839cd635d
                      • Size 395B
                      • SHA256 e257623de12e58b3c0b6e9aad99e37cc626c24ea26849c1db41623008dc2bd09
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      main.log
                      • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
                      • Size 4KB
                      • SHA256 2ab1101b43e941c1459aa3839a64d0ae2a794ed4bc5a3e78f483e887641a2961
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      Proton Drive.lnk
                      • Path C:\Users\Admin\Desktop\Proton Drive.lnk
                      • Size 1KB
                      • SHA256 da72bcf4bcb66f0c6eae402c0724f5594c8c649b50285fe3257b04b92e212301
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Proton Drive.lnk~RFe5a6505.TMP
                      • Path C:\Users\Admin\Desktop\Proton Drive.lnk~RFe5a6505.TMP
                      • Size 1KB
                      • SHA256 266b29eebaa411dba4ccd9e5ac48e51928400a2730fb6c95ae1a2c06eb812e70
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MSI51AD.tmp
                      • Path C:\Windows\Installer\MSI51AD.tmp
                      • Size 322KB
                      • SHA256 667ec687b7137efae7a50880048d4b8db147f297778d5123b63831a1f18844dd
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      MSI52F9.tmp
                      • Path C:\Windows\Installer\MSI52F9.tmp
                      • Size 390KB
                      • SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      CustomAction.config
                      • Path C:\Windows\Installer\SFXCA82336C234A48660A06E1F461978F6613\CustomAction.config
                      • Size 959B
                      • SHA256 7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      Proton.Drive.Installer.Extensions.dll
                      • Path C:\Windows\Installer\SFXCA82336C234A48660A06E1F461978F6613\Proton.Drive.Installer.Extensions.dll
                      • Size 7KB
                      • SHA256 94dd29dc1a052004f50aae08e138725537581b6227dced44d6e6ef117cf8fae3
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      WixToolset.Dtf.WindowsInstaller.dll
                      • Path C:\Windows\Installer\SFXCA82336C234A48660A06E1F461978F6613\WixToolset.Dtf.WindowsInstaller.dll
                      • Size 193KB
                      • SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      logo.png
                      • Path C:\Windows\Temp\{5FC1DA96-96F1-4BC7-BF17-4CEA8B1341D5}\.ba\logo.png
                      • Size 1KB
                      • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wixstdba.dll
                      • Path C:\Windows\Temp\{5FC1DA96-96F1-4BC7-BF17-4CEA8B1341D5}\.ba\wixstdba.dll
                      • Size 215KB
                      • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      VC_redist.x64.exe
                      • Path C:\Windows\Temp\{B9F4BB49-A06D-4C69-B287-4C5C86D64438}\.cr\VC_redist.x64.exe
                      • Size 615KB
                      • SHA256 806e6252db45be78bfc064eb9a774dd1320d8f9aa70dd746996a1d9ddf9b8fd4
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      memory/1228-2766-0x0000000000560000-0x0000000000738000-memory.dmp
                      Download

                      memory/1276-2859-0x00000000007E0000-0x00000000009FE000-memory.dmp
                      Download

                      memory/1828-24-0x0000000003C30000-0x0000000003D70000-memory.dmp
                      Download

                      memory/1828-20-0x0000000000010000-0x00000000003F1000-memory.dmp
                      Download

                      memory/1828-2458-0x0000000000010000-0x00000000003F1000-memory.dmp
                      Download

                      memory/1828-2471-0x0000000000010000-0x00000000003F1000-memory.dmp
                      Download

                      memory/1828-6-0x0000000002700000-0x0000000002701000-memory.dmp
                      Download

                      memory/1828-12-0x0000000003C30000-0x0000000003D70000-memory.dmp
                      Download

                      memory/1828-21-0x0000000002700000-0x0000000002701000-memory.dmp
                      Download

                      memory/1828-812-0x0000000000010000-0x00000000003F1000-memory.dmp
                      Download

                      memory/1828-831-0x0000000003C30000-0x0000000003D70000-memory.dmp
                      Download

                      memory/1828-2447-0x0000000000010000-0x00000000003F1000-memory.dmp
                      Download

                      memory/1828-23-0x0000000000010000-0x00000000003F1000-memory.dmp
                      Download

                      memory/4284-2580-0x000001A5B24A0000-0x000001A5B24A6000-memory.dmp
                      Download

                      memory/4284-2578-0x000001A5B24C0000-0x000001A5B24F4000-memory.dmp
                      Download

                      memory/4312-0-0x00000000006B0000-0x00000000007D5000-memory.dmp
                      Download

                      memory/4312-19-0x00000000006B0000-0x00000000007D5000-memory.dmp
                      Download

                      memory/4312-2473-0x00000000006B0000-0x00000000007D5000-memory.dmp
                      Download

                      memory/5092-2956-0x00000000025A0000-0x00000000025C0000-memory.dmp
                      Download