File scan report
Verdict Safe
Is Proton
No antivirus engine flagged this Proton AG-signed file, while the lone sandbox completed cleanly despite two unconfirmed defensive-evasion technique mappings.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Proton AG
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 70 antivirus engines that checked it flagged the file, and its signature from Proton AG verifies without a brand conflict. One sandbox mapped possible injection and defense impairment, but found no injected target or persistence and returned a clean result; the available evidence therefore strongly favors legitimate software.
The strongest evidence is the complete absence of detections among 75 antivirus engines, including all reporting major antivirus engines. The executable carries a verified Proton AG signature, and its claimed identity does not conflict with the signer. One completed sandbox mapped and T1562.001, but it did not identify an injected target, persistence, malicious child, or malicious sandbox outcome. The antivirus analysis found neither packing nor high-entropy code. Prior adverse results for the same import hash concern differently named, non-matching signers, so they carry little identity weight. A complete contacted-host reputation check was not available, but the only recorded IP was marked as sandbox background traffic rather than sample activity.
What We Detected
None of the 70 antivirus engines that checked it flagged the file, and no engine supplied a malware-family label. The executable has a verified signature from Proton AG, with no detected mismatch between the represented brand and signer.
Threat Behavior
One sandbox run completed with a clean result. It mapped T1055 (Process Injection) and T1562.001 (Impair Defenses), but the saved evidence names no injected target and records no persistence indicators or dropped files. The sole network address was identified as analysis-environment background traffic, while no complete host-reputation cross-check was available.
What To Do Now
Use the file only as part of a Proton VPN installation obtained through Proton's official distribution channel. Keep security software enabled and rescan if the signature becomes invalid, the file appears outside its expected installation directory, or new detections emerge.
Where this verdict could be wrong4 caveats
- The sandbox mapped possible process injection and impairment of defenses, but it identified no injected process, no persistence, and no malicious outcome.
- Historical files sharing this import hash received adverse verdicts, although none shared the Proton AG signer and import hashes can collide across unrelated builds.
- There is no established historical sample record for the Proton AG signer in the supplied evidence.
- No complete reputation result is available for observed hosts, although the only recorded IP was attributed to the sandbox environment rather than the sample.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it reported a detection.
- The digital signature from Proton AG verifies successfully, with no detected brand conflict.
- The completed sandbox run returned a clean result and recorded no persistence or dropped files.
- The antivirus analysis found no packer, likely packing, or high-entropy code.
- The file has moderate circulation, with 54 submitters and 71 submissions.
- The sandbox mapped possible process injection and defense impairment, without enough detail to establish the method, target, or intent.
- No historical trust statistics were available for the signing certificate.
- A complete reputation check of observed hosts was not available.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 8sandbox rule tags
- 2spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
Includes the sandbox verdicts, 8 mapped techniques and every process, file, registry and network entry.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by Proton AG.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 9, 2026, 11:04 PM UTC
- SHA-256
b62671f425fb86c4fb3448775737dae2100934aee66407c2a4b28813c1af8911- SHA-1
bac9214267bd90f4d4c5ec65f12cc846ff574ef9- MD5
bbafd495148b390ef9b98a355ee02157
About this file
ProtonVPN.Launcher.dll is a Win32 EXE file of 18.7 MB.
- Type and size
- Win32 EXE · 18.7 MB
- Signer
- Proton AGValid code signature.
- First seen
- Aug 31, 2026On VirusTotal.
- Submitted by
- 54 distinct sources
- Packer
- None detected
- Entropy
- 6.27 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is ProtonVPN.Launcher.dll safe?
What is ProtonVPN.Launcher.dll?
How many antivirus engines detected ProtonVPN.Launcher.dll?
Is ProtonVPN.Launcher.dll digitally signed?
What is the SHA-256 hash of ProtonVPN.Launcher.dll?
Is it safe to run ProtonVPN.Launcher.dll?
How up to date is this analysis of ProtonVPN.Launcher.dll?
Community
Member reviews and reports for this exact file hash.