Overview

overview

10

Static

static

1

ProtonVPN_...64.exe

windows10-2004-x64

10

ProtonVPN_...64.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    110s
  • max time network
    175s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 08:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProtonVPN_v5.1.6_x64.exe
  • Size 123.8MB
  • Sample260809-kxkdwathmh
  • SHA256 907cea353a28ae0e8274375d49d8df318221c4e205f134575bd76c67b6fd64b1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 28 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    1⤵
      PID:5996
      • C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.6_x64.exe
        "C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.6_x64.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1364
        • C:\Users\Admin\AppData\Local\Temp\is-3D174FA52W.tmp\ProtonVPN_v5.1.6_x64.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-3D174FA52W.tmp\ProtonVPN_v5.1.6_x64.tmp" /SL5="$401AA,128440585,1139200,C:\Users\Admin\AppData\Local\Temp\ProtonVPN_v5.1.6_x64.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5612
          • C:\Users\Admin\AppData\Local\Temp\is-TW0X9NDQL2.tmp\VC_redist.x64.exe
            "C:\Users\Admin\AppData\Local\Temp\is-TW0X9NDQL2.tmp\VC_redist.x64.exe" /install /quiet /norestart
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:6040
            • C:\Windows\Temp\{53A3D87B-4CC6-4C7A-BB8E-C3CCF9B28D7D}\.cr\VC_redist.x64.exe
              "C:\Windows\Temp\{53A3D87B-4CC6-4C7A-BB8E-C3CCF9B28D7D}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-TW0X9NDQL2.tmp\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /install /quiet /norestart
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3704
              • C:\Windows\Temp\{003B5AD6-927B-48D5-B89B-7C2BBC89BD83}\.be\VC_redist.x64.exe
                "C:\Windows\Temp\{003B5AD6-927B-48D5-B89B-7C2BBC89BD83}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{136C4AE9-05D3-490C-B176-60A773D43FEF} {FD304026-9901-49D0-91A2-927A4ED5B9B5} 3704
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5884
          • C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
            "C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:5816
            • C:\Program Files\Proton\VPN\v5.1.6\ProtonVPN.Client.exe
              "v5.1.6\ProtonVPN.Client.exe" -MailInstalled -DriveInstalled -PassInstalled -Language en-US -CleanInstall
              5⤵
              • Adds Run key to start application
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies Control Panel
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:6100
      • C:\Program Files\Proton\VPN\v5.1.6\ProtonInstaller.exe
        C:\Program Files\Proton\VPN\v5.1.6\ProtonInstaller.exe /Mail /Drive /Pass /CreateDesktopShortcut
        2⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:596
        • C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.4.exe
          "C:\Users\Admin\AppData\Local\Temp\Proton%20Drive%20Setup%203.0.4.exe" Source=vpn /quiet NoAppDataCleanup=1 NoAutoLaunch=1
          3⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1584
          • C:\Windows\TEMP\{A1687090-6B0A-467E-9C0D-F83978561BAD}\.ba\wixprqba.exe
            "C:\Windows\TEMP\{A1687090-6B0A-467E-9C0D-F83978561BAD}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{98570812-A7BC-4F5F-9D9E-6EF6F6B383F7} {D50DC8A9-0D79-4688-810F-F3AB2D74B648}
            4⤵
            • Executes dropped EXE
            PID:4520
          • C:\Windows\TEMP\{A1687090-6B0A-467E-9C0D-F83978561BAD}\.ba\wixiuiba.exe
            "C:\Windows\TEMP\{A1687090-6B0A-467E-9C0D-F83978561BAD}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{7D1A4BB8-F398-4793-8BF2-2DE37AD14789} {CDA04F6C-8179-4056-A37A-73A45838266D}
            4⤵
            • Executes dropped EXE
            PID:556
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" -NoProfile -NonInteractive -Command "Add-AppxPackage -Path 'C:\Users\Admin\AppData\Local\Temp\ProtonPass_1.38.1.msix'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          PID:2216
        • C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe
          "C:\Users\Admin\AppData\Local\Temp\ProtonMail-desktop.exe" --source=vpn --silent=1 --auto-launch=0
          3⤵
            PID:5760
            • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
              "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --source=vpn --silent=1 --auto-launch=0
              4⤵
                PID:1912
                • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Squirrel.exe
                  "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                  5⤵
                    PID:2820
                  • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe
                    "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe" --squirrel-install 1.13.4 --source="vpn" --desktop-shortcut=1
                    5⤵
                      PID:4444
                      • C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe
                        "C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\Proton Mail.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Proton Mail" /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Proton Mail\Crashpad" --url=https://mail-api.proton.me/core/v4/reports/sentry/api/54/minidump/?sentry_key=8c45c7615ac54aed9a6747430e0a5d8e "--annotation=_productName=Proton Mail" --annotation=_version=1.13.4 --annotation=plat=Win64 --annotation=prod=Electron "--annotation=sentry___initialScope={\"release\":\"[email protected]+packaged\",\"environment\":\"proton.me\"}" --annotation=ver=40.10.1 --initial-client-data=0x4a8,0x4ac,0x4b0,0x4a4,0x4b4,0x7ff62cd45a0c,0x7ff62cd45a18,0x7ff62cd45a28
                        6⤵
                          PID:5164
                        • C:\Users\Admin\AppData\Local\proton_mail\Update.exe
                          C:\Users\Admin\AppData\Local\proton_mail\Update.exe "--createShortcut=Proton Mail.exe" --shortcut-locations=Desktop,StartMenu
                          6⤵
                            PID:764
                • C:\Program Files\Proton\VPN\v5.1.6\ProtonVPNService.exe
                  "C:\Program Files\Proton\VPN\v5.1.6\ProtonVPNService.exe"
                  1⤵
                  • Executes dropped EXE
                  PID:5888
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Checks SCSI registry key(s)
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5576
                • C:\Windows\system32\srtasks.exe
                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1516
                • C:\Windows\system32\msiexec.exe
                  C:\Windows\system32\msiexec.exe /V
                  1⤵
                  • Adds Run key to start application
                  • Enumerates connected drives
                  • Drops file in Windows directory
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1528
                  • C:\Windows\System32\MsiExec.exe
                    C:\Windows\System32\MsiExec.exe -Embedding 241804514CFA5FC45000A56176DA4323
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:5232
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Windows\Installer\MSIDD61.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240836000 2 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
                      3⤵
                      • Drops file in Windows directory
                      PID:1456
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Windows\Installer\MSIDE3D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240836187 6 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
                      3⤵
                      • Drops file in Windows directory
                      PID:4944
                    • C:\Windows\system32\rundll32.exe
                      rundll32.exe "C:\Windows\Installer\MSIDEF9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240836390 11 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.DoPerMachineUpgradeSupportActions
                      3⤵
                      • Drops file in Windows directory
                      PID:3100
                  • C:\Windows\System32\MsiExec.exe
                    C:\Windows\System32\MsiExec.exe -Embedding 9AE870B9A33E191ABB1557533B8C8B4E
                    2⤵
                      PID:3664
                      • C:\Windows\system32\rundll32.exe
                        rundll32.exe "C:\Windows\Installer\MSIFC8A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240844640 36 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.QueryUserProgramFilesFolder
                        3⤵
                          PID:3356
                        • C:\Windows\system32\rundll32.exe
                          rundll32.exe "C:\Windows\Installer\MSI73.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240845109 40 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.HideCancelButton
                          3⤵
                            PID:3784
                          • C:\Windows\system32\rundll32.exe
                            rundll32.exe "C:\Windows\Installer\MSI1799.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240850875 64 Proton.Drive.Installer.Extensions!Proton.Drive.Installer.Extensions.CustomActions.RemoveStartupEntry
                            3⤵
                              PID:1808
                        • C:\Users\Admin\AppData\Local\Package Cache\{79992F37-A757-4BCD-A130-50F59DF8ECE4}\Proton Drive Setup 3.0.4 (d172203a) (x64).exe
                          "C:\Users\Admin\AppData\Local\Package Cache\{79992F37-A757-4BCD-A130-50F59DF8ECE4}\Proton Drive Setup 3.0.4 (d172203a) (x64).exe" /burn.runonce
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:2756
                          • C:\Users\Admin\AppData\Local\Package Cache\{79992F37-A757-4BCD-A130-50F59DF8ECE4}\Proton Drive Setup 3.0.4 (d172203a) (x64).exe
                            "C:\Users\Admin\AppData\Local\Package Cache\{79992F37-A757-4BCD-A130-50F59DF8ECE4}\Proton Drive Setup 3.0.4 (d172203a) (x64).exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260809100107.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1 /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Proton_Drive_20260809100107.log" /quiet Source=vpn NoAppDataCleanup=1 NoAutoLaunch=1
                            2⤵
                            • Adds Run key to start application
                            • Enumerates connected drives
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4480
                            • C:\Windows\TEMP\{C4346BED-FCA7-4CF1-8F3F-8410DB30F2A9}\.ba\wixprqba.exe
                              "C:\Windows\TEMP\{C4346BED-FCA7-4CF1-8F3F-8410DB30F2A9}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{F623F617-B64E-46A7-835D-B3D7AEE567E9} {F19F4458-4219-4CDF-BB53-CBF3C5451023}
                              3⤵
                              • Executes dropped EXE
                              PID:1660
                            • C:\Windows\TEMP\{C4346BED-FCA7-4CF1-8F3F-8410DB30F2A9}\.ba\wixiuiba.exe
                              "C:\Windows\TEMP\{C4346BED-FCA7-4CF1-8F3F-8410DB30F2A9}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9EDB3B88-DC90-4946-877A-B727A9A40BF2} {9CBAC17A-7E5E-4482-9D01-2545EF7C410A}
                              3⤵
                              • Executes dropped EXE
                              PID:5108
                        • C:\Program Files\Proton\VPN\v5.1.6\ProtonVPNService.exe
                          "C:\Program Files\Proton\VPN\v5.1.6\ProtonVPNService.exe"
                          1⤵
                          • Executes dropped EXE
                          PID:4800
                          • C:\Program Files\Proton\VPN\v5.1.6\ProtonVPN.NrptWatchdog.exe
                            "C:\Program Files\Proton\VPN\v5.1.6\ProtonVPN.NrptWatchdog.exe" --pid 4800
                            2⤵
                              PID:3944
                          • C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe
                            "C:\Users\Admin\AppData\Local\Programs\Proton\Drive\ProtonDrive.exe" -quiet
                            1⤵
                              PID:4088
                            • C:\Program Files\Proton\VPN\v5.1.6\ProtonVPN.NrptWatchdog.exe
                              "C:\Program Files\Proton\VPN\v5.1.6\ProtonVPN.NrptWatchdog.exe"
                              1⤵
                                PID:2556

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    e5ad778.rbs
                                    • Path C:\Config.Msi\e5ad778.rbs
                                    • Size 21KB
                                    • SHA256 723769d80a86047390988550b8e519a608b65164a4bff43c2aa5b7e3dc4c759b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    e5ad77c.rbs
                                    • Path C:\Config.Msi\e5ad77c.rbs
                                    • Size 3KB
                                    • SHA256 668de57ba129e824bd53f7f633387dc4a5d012fb324e37488f5624d3e9a42fd9
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    ProtonVPN.Launcher.exe
                                    • Path C:\Program Files\Proton\VPN\ProtonVPN.Launcher.exe
                                    • Size 17.9MB
                                    • SHA256 decd95dc12ae9b00956ab6b4b21299d3ac96754f3eaba6a3c69b670bf58550cb
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    CoreMessagingXP.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\CoreMessagingXP.dll
                                    • Size 1018KB
                                    • SHA256 2b1d604460a7d44b5e555e9e3068785b96287b034cb120ecc3290fb70260c762
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.Internal.FrameworkUdk.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\Microsoft.Internal.FrameworkUdk.dll
                                    • Size 905KB
                                    • SHA256 51dc87180623b78bcd4933bfbc40ea7bd42efc25a3e5c2b34a47c850a7d0a805
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.UI.Windowing.Core.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\Microsoft.UI.Windowing.Core.dll
                                    • Size 530KB
                                    • SHA256 ca0015abf1533f2f3357c8a6480a6ceb2adda66810f0d5d257da33ef13e3315c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.UI.Xaml.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\Microsoft.UI.Xaml.dll
                                    • Size 14.3MB
                                    • SHA256 f4084263744c5dd5c37cc7dbd1f6a26ad7acf989e306184359b4377f3435319b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.WinUI.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\Microsoft.WinUI.dll
                                    • Size 7.0MB
                                    • SHA256 b745cc38595f48f6b33c02eefc5d5df15a7759ea9e918ce1c18ddf3eb050ce38
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Microsoft.WindowsAppRuntime.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\Microsoft.WindowsAppRuntime.dll
                                    • Size 2.2MB
                                    • SHA256 8d593c4374b193b18ba37b8be8cce093ae4f247423c127ee9c09a63ded3dbb64
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ProtonInstaller.exe
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\ProtonInstaller.exe
                                    • Size 6.0MB
                                    • SHA256 cc918d7bf73869a7c8a70613f24c03daa255ccdc7ef521b36b3113c3d9e584fd
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ProtonVPN.Client.deps.json
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\ProtonVPN.Client.deps.json
                                    • Size 566KB
                                    • SHA256 808996820f812f52b53672506bcc7eb3283db73096779c2d1569f6c571285263
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ProtonVPN.Client.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\ProtonVPN.Client.dll
                                    • Size 3.0MB
                                    • SHA256 ccfbdfc060b42ef669132596f596d8617a54aece49f917f6f1f9173af844cf5b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ProtonVPN.Client.exe
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\ProtonVPN.Client.exe
                                    • Size 590KB
                                    • SHA256 15c37bc3529968995a3226c841ec9cff5321f90c431a17432dd2f99abfc9a8a8
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ProtonVPN.Common.Core.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\ProtonVPN.Common.Core.dll
                                    • Size 72KB
                                    • SHA256 8f8f15219d67525d3c7d29ed6c63aea1aec557edc0d5e002541128e199f1c4ec
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ProtonVPNService.deps.json
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\ProtonVPNService.deps.json
                                    • Size 390KB
                                    • SHA256 06315fcd2dc6f0c6ae9df0d165cda42d3fd70da956d378cc5023de48bea6b38b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ProtonVPNService.exe
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\ProtonVPNService.exe
                                    • Size 466KB
                                    • SHA256 0529f605efcfb020b400411ea8653ee4523c5c56a09afb2c2a887732bdbacf6b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ProtonVPNService.runtimeconfig.json
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\ProtonVPNService.runtimeconfig.json
                                    • Size 629B
                                    • SHA256 becb5e7dbe360a21ec893d5fbed565339094204adeb595a83cb2541e0fc99cb9
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    Sentry.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\Sentry.dll
                                    • Size 787KB
                                    • SHA256 cdc77c11e64cee2c6493492e6e9a3cf8033e5f4cac8f306e7bd37fe7a551c0fe
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.Collections.Concurrent.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\System.Collections.Concurrent.dll
                                    • Size 269KB
                                    • SHA256 0b1545071db0e5e918035aa7103bf8864d504099c6083bed5db94f8657711d74
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.Collections.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\System.Collections.dll
                                    • Size 253KB
                                    • SHA256 a3d31fea1ae85efdbf8cc510e3dada8d6144cf05cdf5c47f70bb4a36054c74ac
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.Linq.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\System.Linq.dll
                                    • Size 529KB
                                    • SHA256 081b23576a9cdb180622191707b9f2dfcbbd0a2b3744d2633979ded32ba1f617
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.Memory.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\System.Memory.dll
                                    • Size 153KB
                                    • SHA256 0550392de886d48bdc5fff6fef9590dd4954c926f765df17037670754d300fe2
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.ObjectModel.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\System.ObjectModel.dll
                                    • Size 77KB
                                    • SHA256 62e0cd6e1585a1f5cd153e2832a03b6dafac0e0ab3331048e7f7bd3dd692f9c4
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.Private.CoreLib.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\System.Private.CoreLib.dll
                                    • Size 12.6MB
                                    • SHA256 29777d3e311415ec7d2f4233e8f44f180b47f1a1c260870714ac95936e52a004
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.Runtime.CompilerServices.Unsafe.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\System.Runtime.CompilerServices.Unsafe.dll
                                    • Size 14KB
                                    • SHA256 13978df865f57310a6fd2a68b6b7c8c3add3e7d222335f191998429c65ebd7c7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.Runtime.InteropServices.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\System.Runtime.InteropServices.dll
                                    • Size 93KB
                                    • SHA256 02f9e9969b29a027ac5fb9f24c681170413231fa8a84da2658120ca11e91b6dc
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.Runtime.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\System.Runtime.dll
                                    • Size 42KB
                                    • SHA256 126facb35c9ba044401173748825e1c4c1197aea7b68e443e2fe8b82fc6f0f5f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    System.Threading.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\System.Threading.dll
                                    • Size 81KB
                                    • SHA256 b734d6a999a1d275ed30bf66e7532175aaae5ad40ffc9bd30ebab458de878b9a
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WinRT.Runtime.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\WinRT.Runtime.dll
                                    • Size 516KB
                                    • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    clrjit.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\clrjit.dll
                                    • Size 1.7MB
                                    • SHA256 bd5936786cedc4119fa0508e41f5104ed351deae5c04c59e612f9c3a7b9aa65b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    coreclr.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\coreclr.dll
                                    • Size 4.8MB
                                    • SHA256 b600c8fdfe3210c55113dc9dc2a6f9e5630cb0b14f4efd8cc56e9d38df075e54
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    hostfxr.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\hostfxr.dll
                                    • Size 357KB
                                    • SHA256 0a495d3a7befebf627a973760439da0f7f1f1667b99832f083664fac7641d2dc
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    hostpolicy.dll
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\hostpolicy.dll
                                    • Size 397KB
                                    • SHA256 aec1393a96946d92ff061ce31a455559b773122218cd62af1df9a8328d60f70b
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    is-UIZXAM50TU.tmp
                                    • Path C:\Program Files\Proton\VPN\v5.1.6\is-UIZXAM50TU.tmp
                                    • Size 237KB
                                    • SHA256 c8e75165887f3db36a30cd508d1f4de7c42f89e788ab7e15c103e828128cf5ca
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ProtonVPN_v5.1.6_x64.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\is-3D174FA52W.tmp\ProtonVPN_v5.1.6_x64.tmp
                                    • Size 3.8MB
                                    • SHA256 0914727ede3fdeb6e42d2375ae53e5493513112706b9d7c1540c39de339ad7ac
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    ProtonVPN.InstallActions.x86.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\is-TW0X9NDQL2.tmp\ProtonVPN.InstallActions.x86.dll
                                    • Size 460KB
                                    • SHA256 bb8581d613f9096c5a267b4f78a12489aae7044631a4cbf250bdd946b814b760
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    VC_redist.x64.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\is-TW0X9NDQL2.tmp\VC_redist.x64.exe
                                    • Size 17.9MB
                                    • SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    squirrel.exe
                                    • Path C:\Users\Admin\AppData\Local\proton_mail\app-1.13.4\squirrel.exe
                                    • Size 2.1MB
                                    • SHA256 1a546fad8c79db03eea7f9bf5bb4c73dfb1f391303547be3917014a220b3ed82
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    Proton Drive.lnk
                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk
                                    • Size 1KB
                                    • SHA256 21342d0ed52ff6b36eca93ba43b67266f184c60fed9765319b59f6cd86f51a22
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    Proton Drive.lnk~RFe5af3d7.TMP
                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Proton\Proton Drive.lnk~RFe5af3d7.TMP
                                    • Size 1KB
                                    • SHA256 23e703bfc4619ac3e6f61ccca44e6747d8977434f283f86f65e7648294636324
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    config.json
                                    • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
                                    • Size 216B
                                    • SHA256 a3d5b70858cc9c9ebbb0ad080da8f365ca8f5090b21e5c96c01dfc3ed7def5ad
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    config.json
                                    • Path C:\Users\Admin\AppData\Roaming\Proton Mail\config.json
                                    • Size 396B
                                    • SHA256 bc0d68196835f7dcd3212d6622444959258c4aa5b7fc807eb20f793fee29b47b
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    main.log
                                    • Path C:\Users\Admin\AppData\Roaming\Proton Mail\logs\main.log
                                    • Size 2KB
                                    • SHA256 5c925d25f1a651ed2491fcfb2319776f45d2ae13e02ca92c8182984e1f3dbe47
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    Proton Drive.lnk
                                    • Path C:\Users\Admin\Desktop\Proton Drive.lnk
                                    • Size 1KB
                                    • SHA256 38e75b89c1a5cc403a136d7af7a378b3e54ced629c2b2d96a5d00a0211132f5a
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    Proton Drive.lnk~RFe5af4f0.TMP
                                    • Path C:\Users\Admin\Desktop\Proton Drive.lnk~RFe5af4f0.TMP
                                    • Size 1KB
                                    • SHA256 008a6bbafed382ff7cb146210176123ca43bc31d5f79dad63afc4b4406bad8b3
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    MSIDEF9.tmp
                                    • Path C:\Windows\Installer\MSIDEF9.tmp
                                    • Size 322KB
                                    • SHA256 54cc20293f708a9d2484a185bd8ce1d244fbe6d679e9b8d0e492474f55b6b3b7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    MSIE064.tmp
                                    • Path C:\Windows\Installer\MSIE064.tmp
                                    • Size 390KB
                                    • SHA256 7aacd4c18710e9bc4ff2034895a0a0c8f80f21809fb177d520e93f7688216e6d
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    CustomAction.config
                                    • Path C:\Windows\Installer\SFXCA7FA2E1CEBD4EF3CB658F31FB1B77492B\CustomAction.config
                                    • Size 959B
                                    • SHA256 7e1096d6f39ebe04d6e38bc714983af05ed92cc2bb4d3365ed4c85e733cb145c
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    Proton.Drive.Installer.Extensions.dll
                                    • Path C:\Windows\Installer\SFXCA7FA2E1CEBD4EF3CB658F31FB1B77492B\Proton.Drive.Installer.Extensions.dll
                                    • Size 7KB
                                    • SHA256 57c808c05dcbc95c79e2c4dd7c467d238c6af1aa010246797ede99741d8f2e0f
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    WixToolset.Dtf.WindowsInstaller.dll
                                    • Path C:\Windows\Installer\SFXCA7FA2E1CEBD4EF3CB658F31FB1B77492B\WixToolset.Dtf.WindowsInstaller.dll
                                    • Size 193KB
                                    • SHA256 a614884ea627da1925131ebf41e8ae202caeac0fe543b86384f5eb2bfaf1aa75
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    logo.png
                                    • Path C:\Windows\Temp\{003B5AD6-927B-48D5-B89B-7C2BBC89BD83}\.ba\logo.png
                                    • Size 1KB
                                    • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    wixstdba.dll
                                    • Path C:\Windows\Temp\{003B5AD6-927B-48D5-B89B-7C2BBC89BD83}\.ba\wixstdba.dll
                                    • Size 215KB
                                    • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    VC_redist.x64.exe
                                    • Path C:\Windows\Temp\{53A3D87B-4CC6-4C7A-BB8E-C3CCF9B28D7D}\.cr\VC_redist.x64.exe
                                    • Size 615KB
                                    • SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    memory/1364-19-0x0000000000C00000-0x0000000000D25000-memory.dmp
                                    Download

                                    memory/1364-2543-0x0000000000C00000-0x0000000000D25000-memory.dmp
                                    Download

                                    memory/1364-0-0x0000000000C00000-0x0000000000D25000-memory.dmp
                                    Download

                                    memory/1456-2603-0x0000022ADE5C0000-0x0000022ADE5F4000-memory.dmp
                                    Download

                                    memory/1456-2605-0x0000022ADD690000-0x0000022ADD696000-memory.dmp
                                    Download

                                    memory/1912-2835-0x00000000001C0000-0x0000000000398000-memory.dmp
                                    Download

                                    memory/2216-2811-0x0000028C22320000-0x0000028C22326000-memory.dmp
                                    Download

                                    memory/2216-2810-0x0000028C22310000-0x0000028C22318000-memory.dmp
                                    Download

                                    memory/2216-2809-0x0000028C22810000-0x0000028C2283A000-memory.dmp
                                    Download

                                    memory/2216-2814-0x0000028C227C0000-0x0000028C227E6000-memory.dmp
                                    Download

                                    memory/2216-2813-0x0000028C22340000-0x0000028C22348000-memory.dmp
                                    Download

                                    memory/2216-2812-0x0000028C22330000-0x0000028C2233A000-memory.dmp
                                    Download

                                    memory/2216-2807-0x0000028C22980000-0x0000028C22B84000-memory.dmp
                                    Download

                                    memory/2216-2806-0x0000028C22560000-0x0000028C22612000-memory.dmp
                                    Download

                                    memory/2216-2808-0x0000028C22770000-0x0000028C2278A000-memory.dmp
                                    Download

                                    memory/2216-2805-0x0000028C22310000-0x0000028C2232E000-memory.dmp
                                    Download

                                    memory/2216-2802-0x0000028C22260000-0x0000028C22282000-memory.dmp
                                    Download

                                    memory/2820-2933-0x0000000000A70000-0x0000000000C8E000-memory.dmp
                                    Download

                                    memory/3944-2794-0x0000021880400000-0x000002188069E000-memory.dmp
                                    Download

                                    memory/4088-2793-0x000001FF98E10000-0x000001FF990AE000-memory.dmp
                                    Download

                                    memory/4800-2792-0x0000017100870000-0x0000017100B0E000-memory.dmp
                                    Download

                                    memory/5612-999-0x00000000009A0000-0x0000000000D81000-memory.dmp
                                    Download

                                    memory/5612-20-0x00000000009A0000-0x0000000000D81000-memory.dmp
                                    Download

                                    memory/5612-21-0x0000000002F60000-0x0000000002F61000-memory.dmp
                                    Download

                                    memory/5612-6-0x0000000002F60000-0x0000000002F61000-memory.dmp
                                    Download

                                    memory/5612-2496-0x00000000009A0000-0x0000000000D81000-memory.dmp
                                    Download

                                    memory/5612-603-0x00000000043F0000-0x0000000004530000-memory.dmp
                                    Download

                                    memory/5612-55-0x00000000009A0000-0x0000000000D81000-memory.dmp
                                    Download

                                    memory/5612-22-0x00000000043F0000-0x0000000004530000-memory.dmp
                                    Download

                                    memory/5612-2510-0x00000000009A0000-0x0000000000D81000-memory.dmp
                                    Download

                                    memory/5612-2475-0x00000000009A0000-0x0000000000D81000-memory.dmp
                                    Download

                                    memory/5612-12-0x00000000043F0000-0x0000000004530000-memory.dmp
                                    Download

                                    memory/5612-2511-0x00000000009A0000-0x0000000000D81000-memory.dmp
                                    Download

                                    memory/6100-2563-0x0000017785000000-0x000001778529E000-memory.dmp
                                    Download

                                    memory/6100-2706-0x0000017785000000-0x000001778529E000-memory.dmp
                                    Download