File name:

pia-windows-x64-3.5.7-08120.exe

Full analysis: https://app.any.run/tasks/c510e55a-760d-4714-bf87-581e1ade913b
Verdict: Malicious activity
Analysis date: June 10, 2024, 00:47:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

C5A4DAD9025BD2196874B395DB2093E7

SHA1:

F38AC163E2064F249190A2CF7B3E50E1C66BEEF8

SHA256:

013A8235CB3126EA004C16A48671CB3045F81031864F2AF56BB9E50A6737EA28

SSDEEP:

393216:ltZJAGZxQBpPmXGawOgKoiOT+w57wghr:jZOB/CgkOFhr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 6776)
      • drvinst.exe (PID: 6828)
      • msiexec.exe (PID: 2680)
      • drvinst.exe (PID: 1448)

    • Drops the executable file immediately after the start

      • drvinst.exe (PID: 6776)
      • drvinst.exe (PID: 6828)
      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)
      • msiexec.exe (PID: 6976)
      • msiexec.exe (PID: 2680)
      • drvinst.exe (PID: 1448)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)
      • drvinst.exe (PID: 6776)
      • drvinst.exe (PID: 6828)
      • msiexec.exe (PID: 2680)
      • drvinst.exe (PID: 1448)

    • Checks Windows Trust Settings

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)
      • drvinst.exe (PID: 6776)
      • drvinst.exe (PID: 1448)

    • Process drops legitimate windows executable

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)

    • Executable content was dropped or overwritten

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)
      • drvinst.exe (PID: 6776)
      • drvinst.exe (PID: 6828)
      • drvinst.exe (PID: 1448)

    • Reads security settings of Internet Explorer

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)

    • The process drops C-runtime libraries

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)

    • Creates files in the driver directory

      • drvinst.exe (PID: 6776)
      • drvinst.exe (PID: 6828)
      • drvinst.exe (PID: 1448)
      • msiexec.exe (PID: 2680)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 6828)

    • Executes as Windows Service

      • pia-service.exe (PID: 6908)
      • VSSVC.exe (PID: 7040)

    • Detected use of alternative data streams (AltDS)

      • pia-client.exe (PID: 7164)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6976)

    • Creates a software uninstall entry

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)

  • INFO

    • Reads the computer name

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)
      • drvinst.exe (PID: 6776)
      • drvinst.exe (PID: 6828)
      • pia-service.exe (PID: 6908)
      • msiexec.exe (PID: 6976)
      • pia-client.exe (PID: 7164)
      • msiexec.exe (PID: 2680)
      • drvinst.exe (PID: 1448)
      • pia-wgservice.exe (PID: 5656)

    • Checks supported languages

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)
      • drvinst.exe (PID: 6776)
      • drvinst.exe (PID: 6828)
      • pia-service.exe (PID: 6908)
      • msiexec.exe (PID: 6976)
      • pia-client.exe (PID: 7164)
      • msiexec.exe (PID: 2680)
      • drvinst.exe (PID: 1448)
      • pia-wgservice.exe (PID: 5656)

    • Creates files in the program directory

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)
      • pia-service.exe (PID: 6908)

    • Reads the machine GUID from the registry

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)
      • drvinst.exe (PID: 6776)
      • pia-service.exe (PID: 6908)
      • drvinst.exe (PID: 1448)

    • Reads the software policy settings

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)
      • drvinst.exe (PID: 6776)
      • drvinst.exe (PID: 1448)

    • Create files in a temporary directory

      • pia-windows-x64-3.5.7-08120.exe (PID: 6460)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6976)
      • msiexec.exe (PID: 2680)

    • Creates files or folders in the user directory

      • pia-client.exe (PID: 7164)

    • Application launched itself

      • msiexec.exe (PID: 6976)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:03:27 12:04:13+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 340992
InitializedDataSize: 21925376
UninitializedDataSize: -
EntryPoint: 0x2cd84
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
14
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pia-windows-x64-3.5.7-08120.exe drvinst.exe drvinst.exe pia-service.exe msiexec.exe vssvc.exe no specs pia-client.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe drvinst.exe pia-wgservice.exe no specs conhost.exe no specs pia-windows-x64-3.5.7-08120.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1448DrvInst.exe "4" "9" "C:\WINDOWS\Temp\6c8506b80b12ca9f35baac96e6ddd0dd17f8ce6c71eb160df627fdf216db7a4a\wintun.inf" "9" "4a936323f" "00000000000001E0" "WinSta0\Default" "00000000000001F0" "208" "C:\WINDOWS\Temp\6c8506b80b12ca9f35baac96e6ddd0dd17f8ce6c71eb160df627fdf216db7a4a"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2680C:\Windows\System32\MsiExec.exe -Embedding 6BB1566589A4803C33EE9B3DDE36B5FB E Global\MSI0000C:\Windows\System32\msiexec.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5428C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5656"C:\Program Files\Private Internet Access\pia-wgservice.exe" /cleaninterface wgpia0C:\Program Files\Private Internet Access\pia-wgservice.exe—pia-service.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\private internet access\pia-wgservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6036\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—pia-wgservice.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6340"C:\Users\admin\Desktop\pia-windows-x64-3.5.7-08120.exe" C:\Users\admin\Desktop\pia-windows-x64-3.5.7-08120.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\pia-windows-x64-3.5.7-08120.exe
c:\windows\system32\ntdll.dll
6460"C:\Users\admin\Desktop\pia-windows-x64-3.5.7-08120.exe" C:\Users\admin\Desktop\pia-windows-x64-3.5.7-08120.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\pia-windows-x64-3.5.7-08120.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6776DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{80471874-1ec1-d74c-8a96-78644a394e15}\oemvista.inf" "9" "4913cc9cb" "00000000000001E0" "WinSta0\Default" "00000000000001F0" "208" "c:\program files\private internet access\tap\win10"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6828DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\WINDOWS\INF\oem1.inf" "oem1.inf:3beb73aff103cc24:tap-pia-0901.ndi:9.24.2.601:tap-pia-0901," "4913cc9cb" "00000000000001EC"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
Total events
19 214
Read events
18 871
Write events
316
Delete events
27

Modification events

(PID) Process:(6460) pia-windows-x64-3.5.7-08120.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piavpn
Operation:writeName:URL Protocol
Value:
(PID) Process:(6460) pia-windows-x64-3.5.7-08120.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
Operation:writeName:setupapi.dev.log
Value:
4096
(PID) Process:(6828) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tap-pia-0901
Operation:writeName:Owners
Value:
oem1.inf
(PID) Process:(6828) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemRoot%/System32/drivers/tap-pia-0901.sys
Operation:writeName:Owners
Value:
oem1.inf
(PID) Process:(6828) drvinst.exeKey:HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\oemvista.inf_amd64_4c9c04020589fe8d\Descriptors\tap-pia-0901
Operation:writeName:Configuration
Value:
tap-pia-0901.ndi
(PID) Process:(6828) drvinst.exeKey:HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\oemvista.inf_amd64_4c9c04020589fe8d\Descriptors\tap-pia-0901
Operation:writeName:Manufacturer
Value:
%provider%
(PID) Process:(6828) drvinst.exeKey:HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\oemvista.inf_amd64_4c9c04020589fe8d\Descriptors\tap-pia-0901
Operation:writeName:Description
Value:
%devicedescription%
(PID) Process:(6828) drvinst.exeKey:HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\oemvista.inf_amd64_4c9c04020589fe8d\Configurations\tap-pia-0901.ndi
Operation:writeName:Service
Value:
tap-pia-0901
(PID) Process:(6828) drvinst.exeKey:HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\oemvista.inf_amd64_4c9c04020589fe8d\Configurations\tap-pia-0901.ndi
Operation:writeName:ConfigScope
Value:
5
(PID) Process:(6828) drvinst.exeKey:HKEY_LOCAL_MACHINE\DRIVERS\DriverDatabase\DriverPackages\oemvista.inf_amd64_4c9c04020589fe8d\Configurations\tap-pia-0901.ndi\Driver\Ndi
Operation:writeName:Service
Value:
tap-pia-0901
Executable files
152
Suspicious files
645
Text files
564
Unknown types
4

Dropped files

PID
Process
Filename
Type
6460pia-windows-x64-3.5.7-08120.exeC:\Program Files\Private Internet Access\architecture.txttext
MD5:0027F42E1E5DFCB4FD5F8F9C6DB89AF3
SHA256:7520B5A1B312EFDE4FD7E2793EF4BC0CF8F1C235F778D203AB7216A0E31B3880
6460pia-windows-x64-3.5.7-08120.exeC:\Program Files\Private Internet Access\LICENSE.txttext
MD5:50B53397867963369D87695B4E70BE7F
SHA256:6EB99D0D071493B43AF549145F3CC311EB8EF593B4FB2D8C9E8A8743255FDA6B
6460pia-windows-x64-3.5.7-08120.exeC:\Program Files\Private Internet Access\Qt\labs\folderlistmodel\plugins.qmltypestext
MD5:3E72475117B4FCA01344C01E945D2E4E
SHA256:5F3888C687398413E1273BC7380FDFA50CBD3D502EB9FF3F63B40BD4D66F29BD
6460pia-windows-x64-3.5.7-08120.exeC:\Program Files\Private Internet Access\brand.txttext
MD5:1A212F8DB4799461E7B4EA4C5316BD4E
SHA256:0CCEDD0B0F8D3B7812836DF5B13D7F24935863F9D1302513E72EDF3ACA2B2261
6460pia-windows-x64-3.5.7-08120.exeC:\Program Files\Private Internet Access\QtGraphicalEffects\BrightnessContrast.qmltext
MD5:4D10A854471E82FE9C1639FA31C650B7
SHA256:98060BFD123D2EE8A00FC6E9EA1C769390EF449CAE69343B84B3D3602769CBB1
6460pia-windows-x64-3.5.7-08120.exeC:\Program Files\Private Internet Access\openvpn_updown.battext
MD5:73A2EE74F3A9556C6649F20C439F6459
SHA256:FB0635A6DA420CA611925EAD022C76815B0A174B6FB37D9EFFF211DAC3E3AA80
6460pia-windows-x64-3.5.7-08120.exeC:\Program Files\Private Internet Access\modern_shadowsocks.jsontext
MD5:E02B8341E944A52C634DBDE7DDECF0B1
SHA256:81DBA9EB3E77C1D87CC742C834C1BB569FF58F7E1CF493693F91C39825BD4053
6460pia-windows-x64-3.5.7-08120.exeC:\Program Files\Private Internet Access\Qt\labs\platform\plugins.qmltypestext
MD5:4B1DAC5DD47A1928E4B1635968774D68
SHA256:2E1A5C057B921CA6AA70BDD28E87F5BE907F6E8AD34B45DD8504E5FE6F92A632
6460pia-windows-x64-3.5.7-08120.exeC:\Program Files\Private Internet Access\modern_region_meta.jsontext
MD5:BEC6CEF4EDE461FE7757D058960F1A33
SHA256:077F3FA286E27561935D0284976E0670FB76F579A140EA9156F1384D298FF584
6460pia-windows-x64-3.5.7-08120.exeC:\Program Files\Private Internet Access\Qt\labs\settings\plugins.qmltypestext
MD5:6669D4C46230AB0F3481099D627FFB99
SHA256:79BF121D97758B4F7982BECB71D50A39C4EF65161857279CB5E53ABC84C4BFEB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
37
DNS requests
9
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5576
svchost.exe
GET
200
2.19.117.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
5576
svchost.exe
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
—
—
GET
200
2.17.0.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
—
—
GET
—
104.18.159.201:443
https://serverlist.piaservers.net/vpninfo/regions/v2
unknown
—
—
—
—
—
POST
204
104.110.240.59:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
—
—
—
GET
200
172.64.151.73:443
https://api.privateinternetaccess.com/api/client/status
unknown
binary
39 b
—
—
—
GET
200
104.19.240.167:443
https://serverlist.piaservers.net/vpninfo/servers/v6
unknown
text
114 Kb
—
—
—
GET
200
104.19.240.167:443
https://serverlist.piaservers.net/shadow_socks
unknown
text
1.50 Kb
—
—
—
GET
200
104.110.240.131:443
https://www.bing.com/manifest/threshold.appcache
unknown
text
3.36 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
5140
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5576
svchost.exe
2.19.117.22:80
crl.microsoft.com
Akamai International B.V.
GB
unknown
5576
svchost.exe
2.17.0.227:80
www.microsoft.com
AKAMAI-AS
DK
unknown
—
—
2.17.0.227:80
www.microsoft.com
AKAMAI-AS
DK
unknown
5140
MoUsoCoreWorker.exe
2.17.0.227:80
www.microsoft.com
AKAMAI-AS
DK
unknown
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
5576
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5140
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.19.117.22
  • 2.19.117.18
whitelisted
www.microsoft.com
  • 2.17.0.227
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
api.privateinternetaccess.com
  • 172.64.151.73
  • 104.18.36.183
unknown
www.privateinternetaccess.com
  • 172.64.151.73
  • 104.18.36.183
unknown
serverlist.piaservers.net
  • 104.19.240.167
  • 104.18.159.201
unknown
r.bing.com
  • 104.110.240.59
  • 104.110.240.131
whitelisted
self.events.data.microsoft.com
  • 52.182.143.214
whitelisted

Threats

PID
Process
Class
Message
—
—
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pia-windows-x64-3.5.7-08120.exe