File name:

privax_vpn_online_setup(3).exe

Full analysis: https://app.any.run/tasks/cb2cd0cf-2898-4774-abaa-74734aeade2d
Verdict: Malicious activity
Analysis date: November 21, 2020, 02:45:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3E5BED8227CE54B360B5D487F68665B2

SHA1:

EB823ADA21ECCA797BF292C91F7937CBE8A3A791

SHA256:

2B19F05886700B16853500C8B7703D371C5642CA2314929B20E61F960559B47F

SSDEEP:

24576:aJtiMpLlTMfCYeVzHYVgggg8HF/4AjThQ57uXkIYdzoDpHsHuGYhhKejnwOW0Y9O:Y7uPgggg8HvTqaOzupMOG+KanwOW0ch+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • privax_vpn_online_setup(3).exe (PID: 1856)

    • Application was dropped or rewritten from another process

      • icarus.exe (PID: 1532)
      • icarus.exe (PID: 3800)
      • icarus_ui.exe (PID: 2272)
      • VpnSvc.exe (PID: 688)
      • VpnUpdate.exe (PID: 3588)
      • VpnUpdate.exe (PID: 3192)
      • Vpn.exe (PID: 1288)
      • Vpn.exe (PID: 2452)
      • Vpn.exe (PID: 2316)

    • Loads dropped or rewritten executable

      • icarus.exe (PID: 3800)
      • VpnSvc.exe (PID: 688)
      • Vpn.exe (PID: 1288)
      • Vpn.exe (PID: 2452)
      • Vpn.exe (PID: 2316)

    • Loads the Task Scheduler COM API

      • icarus.exe (PID: 3800)
      • VpnUpdate.exe (PID: 3588)
      • VpnSvc.exe (PID: 688)

    • Drops executable file immediately after starts

      • VpnSvc.exe (PID: 688)

    • Writes to a start menu file

      • icarus.exe (PID: 3800)

  • SUSPICIOUS

    • Creates files in the program directory

      • privax_vpn_online_setup(3).exe (PID: 1856)
      • icarus.exe (PID: 1532)
      • icarus_ui.exe (PID: 2272)
      • VpnSvc.exe (PID: 688)
      • icarus.exe (PID: 3800)
      • Vpn.exe (PID: 1288)

    • Drops a file that was compiled in debug mode

      • privax_vpn_online_setup(3).exe (PID: 1856)
      • icarus.exe (PID: 1532)
      • VpnSvc.exe (PID: 688)
      • icarus.exe (PID: 3800)

    • Executable content was dropped or overwritten

      • privax_vpn_online_setup(3).exe (PID: 1856)
      • icarus.exe (PID: 1532)
      • VpnSvc.exe (PID: 688)
      • icarus.exe (PID: 3800)

    • Low-level read access rights to disk partition

      • privax_vpn_online_setup(3).exe (PID: 1856)
      • icarus.exe (PID: 1532)
      • icarus.exe (PID: 3800)
      • VpnSvc.exe (PID: 688)

    • Adds / modifies Windows certificates

      • privax_vpn_online_setup(3).exe (PID: 1856)

    • Creates files in the Windows directory

      • privax_vpn_online_setup(3).exe (PID: 1856)
      • icarus.exe (PID: 1532)

    • Creates or modifies windows services

      • icarus.exe (PID: 1532)
      • VpnSvc.exe (PID: 688)

    • Starts itself from another location

      • icarus.exe (PID: 1532)

    • Creates a directory in Program Files

      • icarus.exe (PID: 3800)

    • Drops a file with too old compile date

      • icarus.exe (PID: 3800)
      • VpnSvc.exe (PID: 688)

    • Drops a file with a compile date too recent

      • icarus.exe (PID: 3800)

    • Creates a software uninstall entry

      • icarus.exe (PID: 3800)

    • Executed as Windows Service

      • VpnSvc.exe (PID: 688)

    • Executed via COM

      • unsecapp.exe (PID: 2176)

    • Removes files from Windows directory

      • icarus.exe (PID: 1532)
      • privax_vpn_online_setup(3).exe (PID: 1856)

    • Application launched itself

      • Vpn.exe (PID: 1288)

  • INFO

    • Reads settings of System Certificates

      • privax_vpn_online_setup(3).exe (PID: 1856)

    • Reads the hosts file

      • icarus.exe (PID: 1532)
      • icarus.exe (PID: 3800)
      • VpnSvc.exe (PID: 688)
      • Vpn.exe (PID: 1288)

    • Dropped object may contain Bitcoin addresses

      • icarus.exe (PID: 3800)

    • Manual execution by user

      • Vpn.exe (PID: 1288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:09:12 19:04:31+02:00
PEType: PE32
LinkerVersion: 14.24
CodeSize: 797184
InitializedDataSize: 346624
UninitializedDataSize: -
EntryPoint: 0x28e10
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 20.5.1460.0
ProductVersionNumber: 5.2.5137.722
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Privax Limited
FileDescription: Privax Self-Extract Package
FileVersion: 20.5.1460.0
InternalName: icarus_sfx
LegalCopyright: © 2020 Privax Limited
OriginalFileName: icarus_sfx.exe
ProductId: privax-icarus
ProductName: Privax Installer
ProductVersion: 5.2.5137.722
vpnincluded: 5.2.5137.722

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 12-Sep-2020 17:04:31
Detected languages:
  • English - United States
Debug artifacts:
  • D:\work\190189af1c9958da\BUILDS\Release\x86\icarus_sfx.pdb
CompanyName: Privax Limited
FileDescription: Privax Self-Extract Package
FileVersion: 20.5.1460.0
InternalName: icarus_sfx
LegalCopyright: © 2020 Privax Limited
OriginalFilename: icarus_sfx.exe
ProductId: privax-icarus
ProductName: Privax Installer
ProductVersion: 5.2.5137.722
vpn included: 5.2.5137.722

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000148

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 12-Sep-2020 17:04:31
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_NET_RUN_FROM_SWAP
  • IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000C288A
0x000C2A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.63849
.rdata
0x000C4000
0x0002AB32
0x0002AC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.10006
.data
0x000EF000
0x00008E58
0x00006800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.93135
.didat
0x000F8000
0x0000004C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.805994
.rsrc
0x000F9000
0x0001F008
0x0001F200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.80781
.reloc
0x00119000
0x0000A4EC
0x0000A600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.6276

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.16939
2016
UNKNOWN
English - United States
RT_MANIFEST
2
4.44123
9640
UNKNOWN
English - United States
RT_ICON
3
4.8041
4264
UNKNOWN
English - United States
RT_ICON
4
5.25804
1128
UNKNOWN
English - United States
RT_ICON
5
3.15358
2216
UNKNOWN
English - United States
RT_ICON
6
1.62681
1384
UNKNOWN
English - United States
RT_ICON
7
7.96429
14654
UNKNOWN
English - United States
RT_ICON
8
2.79026
9640
UNKNOWN
English - United States
RT_ICON
9
2.98046
5220
UNKNOWN
English - United States
RT_ICON
10
2.74561
4264
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll (delay-loaded)
gdiplus.dll
ntdll.dll
ole32.dll

Exports

Title
Ordinal
Address
asw_process_storage_allocate_connector
1
0x000271F0
asw_process_storage_deallocate_connector
2
0x00027210
on_avast_dll_unload
3
0x000255B0
onexit_register_connector_avast_2
4
0x00027070
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
12
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start privax_vpn_online_setup(3).exe icarus.exe icarus.exe icarus_ui.exe no specs vpnsvc.exe vpnupdate.exe no specs vpnupdate.exe no specs unsecapp.exe no specs vpn.exe vpn.exe no specs vpn.exe privax_vpn_online_setup(3).exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
688"C:\Program Files\Privax\HMA VPN\VpnSvc.exe"C:\Program Files\Privax\HMA VPN\VpnSvc.exe
services.exe
User:
SYSTEM
Company:
Privax Limited
Integrity Level:
SYSTEM
Description:
Privax VPN Service
Exit code:
0
Version:
5.2.5137.0
Modules
Images
c:\program files\privax\hma vpn\vpnsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1288"C:\Program Files\Privax\HMA VPN\Vpn.exe" C:\Program Files\Privax\HMA VPN\Vpn.exe
explorer.exe
User:
admin
Company:
Privax Limited
Integrity Level:
MEDIUM
Description:
Privax HMA VPN
Exit code:
0
Version:
5.2.5137.0
Modules
Images
c:\program files\privax\hma vpn\vpn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\privax\hma vpn\commonui.dll
c:\program files\privax\hma vpn\aswcmnos.dll
1388"C:\Users\admin\AppData\Local\Temp\privax_vpn_online_setup(3).exe" C:\Users\admin\AppData\Local\Temp\privax_vpn_online_setup(3).exe—explorer.exe
User:
admin
Company:
Privax Limited
Integrity Level:
MEDIUM
Description:
Privax Self-Extract Package
Exit code:
3221226540
Version:
20.5.1460.0
Modules
Images
c:\users\admin\appdata\local\temp\privax_vpn_online_setup(3).exe
c:\systemroot\system32\ntdll.dll
1532C:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\icarus-info.xml /install /sssid:1856C:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\icarus.exe
privax_vpn_online_setup(3).exe
User:
admin
Company:
Privax Limited
Integrity Level:
HIGH
Description:
Privax Installer
Exit code:
0
Version:
20.5.1460.0
Modules
Images
c:\windows\temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\icarus.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1856"C:\Users\admin\AppData\Local\Temp\privax_vpn_online_setup(3).exe" C:\Users\admin\AppData\Local\Temp\privax_vpn_online_setup(3).exe
explorer.exe
User:
admin
Company:
Privax Limited
Integrity Level:
HIGH
Description:
Privax Self-Extract Package
Exit code:
0
Version:
20.5.1460.0
Modules
Images
c:\users\admin\appdata\local\temp\privax_vpn_online_setup(3).exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
2176C:\Windows\system32\wbem\unsecapp.exe -EmbeddingC:\Windows\system32\wbem\unsecapp.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Sink to receive asynchronous callbacks for WMI client application
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\unsecapp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2272C:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\icarus_ui.exe /sssid:1856 /er_master:master_ep_877df0d6-d32d-4a8e-a374-afcbb3e0b9cc /er_ui:ui_ep_024d5831-9e02-43a5-803b-81b2091d9f90C:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\icarus_ui.exe—icarus.exe
User:
admin
Company:
Privax Limited
Integrity Level:
HIGH
Description:
Privax UI
Exit code:
0
Version:
20.5.1460.0
Modules
Images
c:\windows\temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\icarus_ui.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2316"C:\Program Files\Privax\HMA VPN\Vpn.exe" --type=renderer --no-sandbox --autoplay-policy=no-user-gesture-required --field-trial-handle=3076,3322675193264158587,12844763964139005204,131072 --disable-gpu-compositing --service-pipe-token=4341746857691775630 --lang=en-US --log-file="C:\ProgramData\Privax\HMA VPN\log\cef_log.txt" --log-severity=error --user-agent="Chrome/37.0.2062.124 Avastium (17.0)" --proxy-auto-detect --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=4341746857691775630 --renderer-client-id=2 --mojo-platform-channel-handle=2984 /prefetch:1C:\Program Files\Privax\HMA VPN\Vpn.exe—Vpn.exe
User:
admin
Company:
Privax Limited
Integrity Level:
MEDIUM
Description:
Privax HMA VPN
Exit code:
0
Version:
5.2.5137.0
Modules
Images
c:\program files\privax\hma vpn\vpn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\privax\hma vpn\commonui.dll
c:\program files\privax\hma vpn\aswcmnos.dll
2452"C:\Program Files\Privax\HMA VPN\Vpn.exe" --type=gpu-process --field-trial-handle=3076,3322675193264158587,12844763964139005204,131072 --no-sandbox --log-file="C:\ProgramData\Privax\HMA VPN\log\cef_log.txt" --log-severity=error --user-agent="Chrome/37.0.2062.124 Avastium (17.0)" --lang=en-US --proxy-auto-detect --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --allow-file-access-from-files=1 --pack_loading_disabled=1 --gpu-preferences=KAAAAAAAAACAAwCAAQAAAAAAAAAAAGAAAAAAAAMAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --service-request-channel-token=3660111138355888632 --mojo-platform-channel-handle=2632 /prefetch:2C:\Program Files\Privax\HMA VPN\Vpn.exe
Vpn.exe
User:
admin
Company:
Privax Limited
Integrity Level:
MEDIUM
Description:
Privax HMA VPN
Exit code:
0
Version:
5.2.5137.0
Modules
Images
c:\program files\privax\hma vpn\vpn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\privax\hma vpn\commonui.dll
c:\program files\privax\hma vpn\aswcmnos.dll
3192"C:\Program Files\Privax\HMA VPN\VpnUpdate.exe" /regC:\Program Files\Privax\HMA VPN\VpnUpdate.exe—icarus.exe
User:
admin
Company:
Privax Limited
Integrity Level:
HIGH
Description:
Privax VPN Update
Exit code:
183
Version:
5.2.5137.0
Modules
Images
c:\program files\privax\hma vpn\vpnupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\userenv.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\version.dll
Total events
381
Read events
329
Write events
52
Delete events
0

Modification events

(PID) Process:(1856) privax_vpn_online_setup(3).exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1856) privax_vpn_online_setup(3).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
Operation:writeName:Blob
Value:
040000000100000010000000D474DE575C39B2D39C8583C5C065498A0F0000000100000014000000E35EF08D884F0A0ADE2F75E96301CE6230F213A80300000001000000140000005FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC251D00000001000000100000008F76B981D528AD4770088245E2031B630B0000000100000012000000440069006700690043006500720074000000140000000100000014000000B13EC36903F8BF4701D498261A0802EF63642BC36200000001000000200000007431E5F4C3C1CE4690774F0B61E05440883BA9A01ED00BA6ABD7806ED3B118CF5300000001000000230000003021301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0090000000100000034000000303206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B06010505070308190000000100000010000000BA4F3972E7AED9DCCDC210DB59DA13C92000000001000000C9030000308203C5308202ADA003020102021002AC5C266A0B409B8F0B79F2AE462577300D06092A864886F70D0101050500306C310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D312B30290603550403132244696769436572742048696768204173737572616E636520455620526F6F74204341301E170D3036313131303030303030305A170D3331313131303030303030305A306C310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D312B30290603550403132244696769436572742048696768204173737572616E636520455620526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100C6CCE573E6FBD4BBE52D2D32A6DFE5813FC9CD2549B6712AC3D5943467A20A1CB05F69A640B1C4B7B28FD098A4A941593AD3DC94D63CDB7438A44ACC4D2582F74AA5531238EEF3496D71917E63B6ABA65FC3A484F84F6251BEF8C5ECDB3892E306E508910CC4284155FBCB5A89157E71E835BF4D72093DBE3A38505B77311B8DB3C724459AA7AC6D00145A04B7BA13EB510A984141224E656187814150A6795C89DE194A57D52EE65D1C532C7E98CD1A0616A46873D03404135CA171D35A7C55DB5E64E13787305604E511B4298012F1793988A202117C2766B788B778F2CA0AA838AB0A64C2BF665D9584C1A1251E875D1A500B2012CC41BB6E0B5138B84BCB0203010001A3633061300E0603551D0F0101FF040403020186300F0603551D130101FF040530030101FF301D0603551D0E04160414B13EC36903F8BF4701D498261A0802EF63642BC3301F0603551D23041830168014B13EC36903F8BF4701D498261A0802EF63642BC3300D06092A864886F70D010105050003820101001C1A0697DCD79C9F3C886606085721DB2147F82A67AABF183276401057C18AF37AD911658E35FA9EFC45B59ED94C314BB891E8432C8EB378CEDBE3537971D6E5219401DA55879A2464F68A66CCDE9C37CDA834B1699B23C89E78222B7043E35547316119EF58C5852F4E30F6A0311623C8E7E2651633CBBF1A1BA03DF8CA5E8B318B6008892D0C065C52B7C4F90A98D1155F9F12BE7C366338BD44A47FE4262B0AC497690DE98CE2C01057B8C876129155F24869D8BC2A025B0F44D42031DBF4BA70265D90609EBC4B17092FB4CB1E4368C90727C1D25CF7EA21B968129C3C9CBF9EFC805C9B63CDEC47AA252767A037F300827D54D7A9F8E92E13A377E81F4A
(PID) Process:(1532) icarus.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\partmgr
Operation:writeName:EnableCounterForIoctl
Value:
1
(PID) Process:(1532) icarus.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:BootExecute
Value:
autocheck autochk *
(PID) Process:(1532) icarus.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Software\Privax\Icarus
Operation:writeName:DataFolder
Value:
C:\ProgramData\Privax\Icarus
(PID) Process:(688) VpnSvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\partmgr
Operation:writeName:EnableCounterForIoctl
Value:
1
(PID) Process:(688) VpnSvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Privax\HMA! Pro VPN
Operation:writeName:AnonymousGuid
Value:
7895b28c-590b-477d-865f-64d94e2dfaae
(PID) Process:(3800) icarus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Privax\HMA! Pro VPN
Operation:writeName:ProgramFolder
Value:
C:\Program Files\Privax\HMA VPN
(PID) Process:(3800) icarus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Privax\HMA! Pro VPN
Operation:writeName:SetupFolder
Value:
C:\Program Files\Common Files\Privax\Icarus\privax-vpn
(PID) Process:(3800) icarus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Privax\HMA! Pro VPN
Operation:writeName:DataFolder
Value:
C:\ProgramData\Privax\HMA VPN
Executable files
185
Suspicious files
34
Text files
180
Unknown types
125

Dropped files

PID
Process
Filename
Type
1856privax_vpn_online_setup(3).exeC:\ProgramData\Privax\Icarus\Logs\sfx.log —
MD5:—
SHA256:—
1856privax_vpn_online_setup(3).exeC:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\4d60726c-dd72-477b-813c-f7dabbbee86c —
MD5:—
SHA256:—
1856privax_vpn_online_setup(3).exeC:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\df1688b4-a6c8-4cf4-86bd-0f9eb3947a3f —
MD5:—
SHA256:—
1856privax_vpn_online_setup(3).exeC:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\1fc7efdf-3475-4fc5-9ced-724f1a203a0c —
MD5:—
SHA256:—
1856privax_vpn_online_setup(3).exeC:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\1e70bc4c-0928-44df-b567-09058ead92f4 —
MD5:—
SHA256:—
1856privax_vpn_online_setup(3).exeC:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\ece5fbdf-ecd7-4579-9a56-09d9f728db95 —
MD5:—
SHA256:—
1856privax_vpn_online_setup(3).exeC:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\caa56f29-6daf-45f8-a324-7b0ac5446da0 —
MD5:—
SHA256:—
1856privax_vpn_online_setup(3).exeC:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\49fa63b7-b9f8-49a0-8923-5a808bc2715e —
MD5:—
SHA256:—
1856privax_vpn_online_setup(3).exeC:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\16d5a81b-a6f1-41c1-bf8c-c49f9012e983 —
MD5:—
SHA256:—
1856privax_vpn_online_setup(3).exeC:\Windows\Temp\asw-a563fdab-076b-430f-ab3d-ff818248e3a6\common\484a08e0-dbac-4194-85f5-4eee982b4bb3 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
32
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1856
privax_vpn_online_setup(3).exe
GET
404
23.212.157.65:80
http://honzik.avcdn.net/dll/privax-vpn/x86/icarus_mod.dll.lzma
US
html
236 b
malicious
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
688
VpnSvc.exe
GET
200
92.122.188.13:80
http://ncc.avast.com/ncc.txt
unknown
text
26 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1532
icarus.exe
77.234.42.66:443
shepherd.ff.avast.com
AVAST Software s.r.o.
US
suspicious
1532
icarus.exe
5.62.40.212:443
analytics.ff.avast.com
AVAST Software s.r.o.
DE
unknown
3800
icarus.exe
23.212.157.65:443
honzik.avcdn.net
GTT Communications Inc.
US
malicious
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3800
icarus.exe
5.62.40.201:443
shepherd.ff.avast.com
AVAST Software s.r.o.
DE
suspicious
688
VpnSvc.exe
77.234.42.66:443
shepherd.ff.avast.com
AVAST Software s.r.o.
US
suspicious
688
VpnSvc.exe
5.62.40.201:443
shepherd.ff.avast.com
AVAST Software s.r.o.
DE
suspicious
688
VpnSvc.exe
5.62.40.127:443
slcw.ff.avast.com
AVAST Software s.r.o.
DE
unknown
—
—
109.230.227.90:123
1.pool.ntp.org
Dennis Rainer Warnholz trading as active-servers.com
DE
unknown
1532
icarus.exe
5.62.40.211:443
analytics.ff.avast.com
AVAST Software s.r.o.
DE
unknown

DNS requests

Domain
IP
Reputation
analytics.ff.avast.com
  • 5.62.40.211
  • 5.62.40.212
whitelisted
honzik.avcdn.net
  • 23.212.157.65
unknown
shepherd.ff.avast.com
  • 77.234.42.66
  • 5.62.40.201
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ncc.avast.com
  • 92.122.188.13
  • 92.122.188.40
whitelisted
0.pool.ntp.org
  • 131.188.3.223
  • 94.130.49.186
  • 145.239.0.195
  • 144.76.0.164
whitelisted
1.pool.ntp.org
  • 109.230.227.90
  • 81.209.141.242
  • 212.112.228.242
  • 131.234.220.231
whitelisted
2.pool.ntp.org
  • 49.12.125.53
  • 116.202.14.29
  • 173.249.33.207
  • 62.116.130.3
whitelisted
slcw.ff.avast.com
  • 5.62.40.127
  • 5.62.40.123
  • 5.62.36.50
  • 5.62.40.117
whitelisted
3.pool.ntp.org
  • 62.128.1.19
  • 94.16.116.137
  • 62.116.162.126
  • 217.144.138.234
whitelisted

Threats

No threats detected
Process
Message
Vpn.exe
[2020-11-21 02:47:17.514] [error ] [vpn ] [ 1288: 1880] Exception: Request 'app.vpn.CheckForIcarusUpdate' was not processed. Routing parameters:
Vpn.exe
[1121/024718.174:ERROR:viz_main_impl.cc(184)] Exiting GPU process due to errors during initialization
Vpn.exe
[2020-11-21 02:47:18.701] [error ] [vpn ] [ 1288: 1672] Exception: SVC not connected
Vpn.exe
[2020-11-21 02:47:18.701] [error ] [vpn ] [ 1288: 1672] Exception: SVC not connected
Vpn.exe
[2020-11-21 02:47:18.701] [error ] [vpn ] [ 1288: 1672] Exception: SVC not connected
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
privax_vpn_online_setup(3).exe