File name:

hma_pro_vpn_setup.exe

Full analysis: https://app.any.run/tasks/dfa30716-120a-4080-8114-77e12f648dd4
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 19:06:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

48595EEAC7B46D40C17C1FB9D033AB56

SHA1:

994189231E9D399F45C5D05E7652F8D606616457

SHA256:

634F0AA57F763CFF8C6FF88E09B0492AA71D616BFFA33212B41859D68940507A

SSDEEP:

98304:I+fg1KUGwpxOdQWswI2wnZTwaTn+H5zQkhfbQUzlm+PHcnwAIYRz/qeKglS2gqGk:J7Ef2pBIr5afMdL6fFsYkkPoOy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • googel.exe (PID: 7308)

    • NjRAT is detected

      • googel.exe (PID: 7308)

    • Create files in the Startup directory

      • hma_pro_vpn_setup.tmp (PID: 7336)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • hma_pro_vpn_setup.exe (PID: 7516)
      • hma_pro_vpn_setup.exe (PID: 4776)
      • ConsoleApplication1.exe (PID: 4784)
      • hma_pro_vpn_setup.tmp (PID: 7336)
      • TiWorker.exe (PID: 7724)

    • There is functionality for taking screenshot (YARA)

      • hma_pro_vpn_setup.exe (PID: 7516)

    • Creates a software uninstall entry

      • hma_pro_vpn_setup.exe (PID: 7516)

    • Reads security settings of Internet Explorer

      • ConsoleApplication1.exe (PID: 4784)
      • hma_pro_vpn_setup.tmp (PID: 7336)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • googel.exe (PID: 7308)

    • Process drops legitimate windows executable

      • hma_pro_vpn_setup.tmp (PID: 7336)
      • TiWorker.exe (PID: 7724)

    • The process drops C-runtime libraries

      • hma_pro_vpn_setup.tmp (PID: 7336)
      • TiWorker.exe (PID: 7724)

    • Drops a system driver (possible attempt to evade defenses)

      • hma_pro_vpn_setup.tmp (PID: 7336)

    • Starts itself from another location

      • ConsoleApplication1.exe (PID: 4784)

    • Executes as Windows Service

      • VpnSvc.exe (PID: 3884)

    • Application launched itself

      • Vpn.exe (PID: 6512)

  • INFO

    • The sample compiled with english language support

      • hma_pro_vpn_setup.exe (PID: 7516)
      • hma_pro_vpn_setup.tmp (PID: 7336)
      • TiWorker.exe (PID: 7724)

    • Creates files in the program directory

      • hma_pro_vpn_setup.exe (PID: 7516)
      • hma_pro_vpn_setup.tmp (PID: 7336)
      • Vpn.exe (PID: 6512)

    • Reads the computer name

      • hma_pro_vpn_setup.exe (PID: 7516)
      • ConsoleApplication1.exe (PID: 4784)
      • hma_pro_vpn_setup.tmp (PID: 7336)
      • Vpn.exe (PID: 6512)

    • Checks supported languages

      • hma_pro_vpn_setup.exe (PID: 7516)
      • ConsoleApplication1.exe (PID: 4784)
      • hma_pro_vpn_setup.exe (PID: 4776)
      • hma_pro_vpn_setup.tmp (PID: 7336)
      • _setup64.tmp (PID: 7020)

    • Process checks computer location settings

      • hma_pro_vpn_setup.exe (PID: 7516)

    • Reads the machine GUID from the registry

      • ConsoleApplication1.exe (PID: 4784)

    • Create files in a temporary directory

      • hma_pro_vpn_setup.exe (PID: 7516)
      • hma_pro_vpn_setup.exe (PID: 4776)
      • ConsoleApplication1.exe (PID: 4784)
      • hma_pro_vpn_setup.tmp (PID: 7336)

    • Creates files or folders in the user directory

      • hma_pro_vpn_setup.tmp (PID: 7336)

    • The sample compiled with czech language support

      • hma_pro_vpn_setup.tmp (PID: 7336)

    • Autorun file from Startup directory

      • hma_pro_vpn_setup.tmp (PID: 7336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (49.2)
.exe | Win32 Executable Delphi generic (16.2)
.scr | Windows screen saver (14.9)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 148992
InitializedDataSize: 31744
UninitializedDataSize: -
EntryPoint: 0x25468
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: -
CompanyName: Company
FileDescription: HMA! Pro VPN 4.0.110 1.00 Installation
FileVersion: 1.00
LegalCopyright: Company
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
25
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hma_pro_vpn_setup.exe sppextcomobj.exe no specs slui.exe no specs consoleapplication1.exe hma_pro_vpn_setup.exe hma_pro_vpn_setup.tmp #NJRAT googel.exe vpnsetupwatchdog.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs svchost.exe _setup64.tmp no specs conhost.exe no specs installcrt.exe no specs conhost.exe no specs tiworker.exe vpnupdate.exe no specs vpnsvc.exe vpn.exe avbugreport.exe no specs conhost.exe no specs vpn.exe no specs vpn.exe no specs hma_pro_vpn_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Users\admin\AppData\Local\Temp\is-QS0JU.tmp\VpnSetupWatchdog.exe" /setup-pid:7336 /watchdog-watching-evt:Local\HmaProVpnSetupWatchdogIsWatchingEvent /setup-log:"C:\Users\admin\AppData\Local\Temp\Setup Log 2025-03-24 #001.txt"C:\Users\admin\AppData\Local\Temp\is-QS0JU.tmp\VpnSetupWatchdog.exe—hma_pro_vpn_setup.tmp
User:
admin
Company:
Autogenerated
Integrity Level:
HIGH
Description:
VPN Setup Watchdog
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\is-qs0ju.tmp\vpnsetupwatchdog.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—InstallCrt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3240"C:\Program Files (x86)\HMA! Pro VPN\Vpn.exe" --type=renderer --disable-gpu-compositing --disable-pinch --no-sandbox --lang=en-US --lang=en-US --log-file="C:\ProgramData\Privax\HMA! Pro VPN\cef\log\cef_log.txt" --log-severity=error --user-agent="Chrome/37.0.2062.124 Avastium (17.0)" --proxy-auto-detect --disable-webaudio --force-wave-audio --disable-software-rasterizer --no-sandbox --blacklist-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-compositing --disable-accelerated-layers --disable-accelerated-video-decode --blacklist-webgl --disable-bundled-ppapi-flash --disable-flash-3d --enable-aggressive-domstorage-flushing --enable-media-stream --allow-file-access-from-files=1 --pack_loading_disabled=1 --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="6512.0.870038141\1760487283" /prefetch:1C:\Program Files (x86)\HMA! Pro VPN\Vpn.exe—Vpn.exe
User:
admin
Company:
Privax Limited
Integrity Level:
HIGH
Description:
HMA! Pro VPN
Version:
4.0.110.0
Modules
Images
c:\program files (x86)\hma! pro vpn\vpn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
3884"C:\Program Files (x86)\HMA! Pro VPN\VpnSvc.exe"C:\Program Files (x86)\HMA! Pro VPN\VpnSvc.exe
services.exe
User:
SYSTEM
Company:
Privax Limited
Integrity Level:
SYSTEM
Description:
HMA! Pro VPN Service
Version:
4.0.110.0
Modules
Images
c:\program files (x86)\hma! pro vpn\vpnsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4120netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\googel.exe" "googel.exe" ENABLEC:\Windows\System32\netsh.exe—googel.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4776"C:\Program Files (x86)\hma_pro_vpn_setup.exe"C:\Program Files (x86)\hma_pro_vpn_setup.exe
hma_pro_vpn_setup.exe
User:
admin
Company:
Privax
Integrity Level:
HIGH
Description:
HMA! Pro VPN Setup
Exit code:
0
Version:
4.0.110.0
Modules
Images
c:\program files (x86)\hma_pro_vpn_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
4784"C:\WINDOWS\ConsoleApplication1.exe" C:\Windows\ConsoleApplication1.exe
hma_pro_vpn_setup.exe
User:
admin
Integrity Level:
HIGH
Description:
ConsoleApplication1
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\windows\consoleapplication1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—VpnSetupWatchdog.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 218
Read events
5 887
Write events
270
Delete events
61

Modification events

(PID) Process:(7516) hma_pro_vpn_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HMA! Pro VPN 4.0.110 1.00
Operation:writeName:Publisher
Value:
Company
(PID) Process:(7516) hma_pro_vpn_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HMA! Pro VPN 4.0.110 1.00
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\Company\HMA! Pro VPN 4.0.110\Uninstall.exe
(PID) Process:(7516) hma_pro_vpn_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HMA! Pro VPN 4.0.110 1.00
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\Company\HMA! Pro VPN 4.0.110\Uninstall.exe
(PID) Process:(7516) hma_pro_vpn_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HMA! Pro VPN 4.0.110 1.00
Operation:writeName:InstallDate
Value:
20250324
(PID) Process:(7516) hma_pro_vpn_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HMA! Pro VPN 4.0.110 1.00
Operation:writeName:Language
Value:
1033
(PID) Process:(7516) hma_pro_vpn_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HMA! Pro VPN 4.0.110 1.00
Operation:writeName:EstimatedSize
Value:
14685
(PID) Process:(7516) hma_pro_vpn_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HMA! Pro VPN 4.0.110 1.00
Operation:writeName:DisplayName
Value:
HMA! Pro VPN 4.0.110 1.00
(PID) Process:(7516) hma_pro_vpn_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HMA! Pro VPN 4.0.110 1.00
Operation:writeName:DisplayVersion
Value:
1.00
(PID) Process:(7516) hma_pro_vpn_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HMA! Pro VPN 4.0.110 1.00
Operation:writeName:VersionMajor
Value:
1
(PID) Process:(7516) hma_pro_vpn_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\HMA! Pro VPN 4.0.110 1.00
Operation:writeName:VersionMinor
Value:
0
Executable files
267
Suspicious files
115
Text files
61
Unknown types
0

Dropped files

PID
Process
Filename
Type
7516hma_pro_vpn_setup.exeC:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmp —
MD5:—
SHA256:—
7516hma_pro_vpn_setup.exeC:\Users\admin\AppData\Local\Temp\$inst\0001.tmp —
MD5:—
SHA256:—
7336hma_pro_vpn_setup.tmpC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\cef_3.2623.1396[1].htm —
MD5:—
SHA256:—
7336hma_pro_vpn_setup.tmpC:\Users\admin\AppData\Local\Temp\is-QS0JU.tmp\cef_3.2623.1396.cab —
MD5:—
SHA256:—
7516hma_pro_vpn_setup.exeC:\Users\admin\AppData\Local\Temp\$inst\5.tmpimage
MD5:AB2021E67E0E08657288D880ABFBAA72
SHA256:331D997E586CBA40D4DA0587887FC4CAA4CC44E53421737DAFA67E67445E6753
7516hma_pro_vpn_setup.exeC:\Users\admin\AppData\Local\Temp\$inst\8.tmpimage
MD5:BAC172B887BC7D09DB5E14CE26A4943E
SHA256:AAA3BEE9EBD3640C05B8A70F22C9FBDB8EA0E61CA3762DB5A4583E94D46A5C79
7516hma_pro_vpn_setup.exeC:\Program Files (x86)\Company\HMA! Pro VPN 4.0.110\Uninstall.initext
MD5:B178B1233EE3411A2797946F8122137E
SHA256:E4AD8B83FFD211647435F37B3828CF4F6B0C0E0269CA780788AF61A7A99DA8A6
7516hma_pro_vpn_setup.exeC:\Windows\ConsoleApplication1.exeexecutable
MD5:C659E7B9A848A27A1FA7EF71B4712803
SHA256:5188AB56CDF42BD22D6CE5499C4D9D04FD9B38544CA0E16914CB8387436EA71A
7516hma_pro_vpn_setup.exeC:\Program Files (x86)\Company\HMA! Pro VPN 4.0.110\Uninstall.exeexecutable
MD5:499CCC8D6D7C08E135A91928CCC2FD7A
SHA256:1FA5D83A5766556CF2FF16AD279E73CB40584746BD388E0A4E818A2CC06613D3
4784ConsoleApplication1.exeC:\Users\admin\AppData\Local\Temp\googel.exeexecutable
MD5:C659E7B9A848A27A1FA7EF71B4712803
SHA256:5188AB56CDF42BD22D6CE5499C4D9D04FD9B38544CA0E16914CB8387436EA71A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
31
DNS requests
31
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7796
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7336
hma_pro_vpn_setup.tmp
GET
200
184.24.77.163:80
http://hma.privax.tools.avcdn.net/tools/privax/hma/cef_3.2623.1396.cab
unknown
—
—
whitelisted
5064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
756
lsass.exe
GET
200
142.250.185.131:80
http://o.pki.goog/s/wr3/uBU/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEQC4FVoDSnM%2BPRLxsOokZV0N
unknown
—
—
whitelisted
6512
Vpn.exe
GET
200
2.16.10.176:80
http://hma.privax.tools.avcdn.net/tools/privax/hma/hmaprovpn.cfg
unknown
—
—
whitelisted
756
lsass.exe
GET
200
142.250.185.131:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
756
lsass.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7796
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7796
backgroundTaskHost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.176
  • 23.48.23.166
  • 23.48.23.164
  • 23.48.23.180
  • 23.48.23.141
  • 23.48.23.169
  • 23.48.23.143
  • 23.48.23.177
  • 23.48.23.173
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.64
  • 40.126.32.138
  • 20.190.160.66
  • 20.190.160.131
  • 40.126.32.133
  • 40.126.32.136
  • 20.190.160.65
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
hma.privax.tools.avcdn.net
  • 184.24.77.163
  • 184.24.77.165
  • 2.16.10.176
  • 2.16.10.175
whitelisted
machouche17.ddns.net
  • —
malicious
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
—
—
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
Process
Message
VpnSvc.exe
[2025-03-24 19:07:36.527] [error ] [ffl2 ] [ 3884: 7804] failed to load key 0 (error 2)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hma_pro_vpn_setup.exe