| File name: | ProtonVPN.exe |
| Full analysis: | https://app.any.run/tasks/9c042760-143d-4b7f-a428-f28961a26836 |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | April 24, 2025, 17:42:12 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (console) x86-64, for MS Windows, 6 sections |
| MD5: | 164B4105099E80278A3063E4F777A120 |
| SHA1: | 5E9EA6D1F0DEC01D44FE69A51F902D7536F1FC6A |
| SHA256: | 8E56AF917CB649665D57B6B8A19DDAA5C814039E42C9E19E4464A0565E6C5450 |
| SSDEEP: | 98304:EOxGCu8M4H4ddvgOVWjtKxg8pN2QwfmMRTHfTHHZPthn6YDEbn6kqH5YgUzYz9pG:VTbVw8YCNY3pIwsg6 |
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:02:19 22:30:32+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.4 |
| CodeSize: | 175104 |
| InitializedDataSize: | 101888 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xbcf0 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1804 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 2136 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | ProtonVPN.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2140 | "C:\Users\admin\Desktop\ProtonVPN.exe" | C:\Users\admin\Desktop\ProtonVPN.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 2772 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5904 -childID 7 -isForBrowser -prefsHandle 5976 -prefMapHandle 5980 -prefsLen 31324 -prefMapSize 244583 -jsInitHandle 1496 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eeeb0c28-e85b-4851-ad70-986170e5ed8e} 1804 "\\.\pipe\gecko-crash-server-pipe.1804" 1bf6d6324d0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 2852 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3888 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1912 -parentBuildID 20240213221259 -prefsHandle 1840 -prefMapHandle 1832 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e356793-4e56-40c8-abd9-86aace871591} 1804 "\\.\pipe\gecko-crash-server-pipe.1804" 1bf603eee10 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 1 Version: 123.0 Modules
| |||||||||||||||
| 5200 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | ProtonVPN.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5508 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5644 -childID 6 -isForBrowser -prefsHandle 5608 -prefMapHandle 4572 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1496 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30db8664-3314-490e-8798-9ea802a96fdf} 1804 "\\.\pipe\gecko-crash-server-pipe.1804" 1bf6bc2e4d0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 6372 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 6644 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2152 -parentBuildID 20240213221259 -prefsHandle 2144 -prefMapHandle 2132 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {676972b5-87b7-4f3a-b843-cbd2abc131b9} 1804 "\\.\pipe\gecko-crash-server-pipe.1804" 1bf53680910 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| (PID) Process: | (1804) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (1804) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU |
| Operation: | write | Name: | NodeSlots |
Value: 02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202 | |||
| (PID) Process: | (1804) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU |
| Operation: | write | Name: | MRUListEx |
Value: 04000000030000000E00000000000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF | |||
| (PID) Process: | (1804) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4 |
| Operation: | write | Name: | MRUListEx |
Value: 010000000000000004000000050000000200000003000000FFFFFFFF | |||
| (PID) Process: | (1804) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | GlobalAssocChangedCounter |
Value: 114 | |||
| (PID) Process: | (1804) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\34\Shell |
| Operation: | write | Name: | SniffedFolderType |
Value: Pictures | |||
| (PID) Process: | (1804) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\34\Shell |
| Operation: | write | Name: | SniffedFolderType |
Value: Generic | |||
| (PID) Process: | (1804) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\exe |
| Operation: | write | Name: | 2 |
Value: 14001F50E04FD020EA3A6910A2D808002B30309D14002E803ACCBFB42CDB4C42B0297FE99A87C64168003200E9629500985A498D200050524F544F4E7E312E45584500004C0009000400EFBE985A498D985A498D2E0000008D0800000000150000000000000000000000000000007F932900500072006F0074006F006E00560050004E002E0065007800650000001C000000 | |||
| (PID) Process: | (1804) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\exe |
| Operation: | write | Name: | MRUListEx |
Value: 020000000100000000000000FFFFFFFF | |||
| (PID) Process: | (1804) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\* |
| Operation: | write | Name: | 8 |
Value: 14001F50E04FD020EA3A6910A2D808002B30309D14002E803ACCBFB42CDB4C42B0297FE99A87C64168003200E9629500985A498D200050524F544F4E7E312E45584500004C0009000400EFBE985A498D985A498D2E0000008D0800000000150000000000000000000000000000007F932900500072006F0074006F006E00560050004E002E0065007800650000001C000000 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2140 | ProtonVPN.exe | C:\Users\admin\AppData\Local\Temp\_MEI21402\_py_abc.pyc | binary | |
MD5:7A408C1218E8AEE594B89D6FF2400903 | SHA256:16108604C0D58C699155ADCED128D325EA0374E6515AECD4F1748BA8740D37CB | |||
| 2140 | ProtonVPN.exe | C:\Users\admin\AppData\Local\Temp\_MEI21402\_hashlib.pyd | executable | |
MD5:D4674750C732F0DB4C4DD6A83A9124FE | SHA256:CAA4D2F8795E9A55E128409CC016E2CC5C694CB026D7058FC561E4DD131ED1C9 | |||
| 2140 | ProtonVPN.exe | C:\Users\admin\AppData\Local\Temp\_MEI21402\_compat_pickle.pyc | binary | |
MD5:FA8B93EA8E977A9B8B8C4DF6DDD1C46C | SHA256:3A70F95ADCA385FBAF74B07DD1AE0714A45952DE67F45A638258AF407B329962 | |||
| 2140 | ProtonVPN.exe | C:\Users\admin\AppData\Local\Temp\_MEI21402\_cffi_backend.cp310-win_amd64.pyd | executable | |
MD5:282B92EF9ED04C419564FBAEE2C5CDBE | SHA256:5763C1D29903567CDE4D46355D3A7380D10143543986CA4EEBFCA4D22D991E3E | |||
| 2140 | ProtonVPN.exe | C:\Users\admin\AppData\Local\Temp\_MEI21402\_compression.pyc | binary | |
MD5:720CB15D3B7E81E5F5B94D49342A1E82 | SHA256:30D93ED2C952313FA7DAD7441A91A7895B7F8639CB659C2DCDFCA18F0FCDFCFC | |||
| 2140 | ProtonVPN.exe | C:\Users\admin\AppData\Local\Temp\_MEI21402\_pydecimal.pyc | binary | |
MD5:DFBFD792852F1AA7A8090F11C14C234A | SHA256:04B01CCB96B1B7E1C183156E440B6010C39896F5F7F71793CF78EC038AD5CDDE | |||
| 2140 | ProtonVPN.exe | C:\Users\admin\AppData\Local\Temp\_MEI21402\__future__.pyc | binary | |
MD5:A60B1334D3429A02E70C5A0574F2AF5D | SHA256:F18CB1E450A6C67182ADC35C75A89F66E35F4215D7945DEA21FB429DAABAD20B | |||
| 2140 | ProtonVPN.exe | C:\Users\admin\AppData\Local\Temp\_MEI21402\_bz2.pyd | executable | |
MD5:86D1B2A9070CD7D52124126A357FF067 | SHA256:62173A8FADD4BF4DD71AB89EA718754AA31620244372F0C5BBBAE102E641A60E | |||
| 2140 | ProtonVPN.exe | C:\Users\admin\AppData\Local\Temp\_MEI21402\VCRUNTIME140.dll | executable | |
MD5:F34EB034AA4A9735218686590CBA2E8B | SHA256:9D2B40F0395CC5D1B4D5EA17B84970C29971D448C37104676DB577586D4AD1B1 | |||
| 2140 | ProtonVPN.exe | C:\Users\admin\AppData\Local\Temp\_MEI21402\_ssl.pyd | executable | |
MD5:7910FB2AF40E81BEE211182CFFEC0A06 | SHA256:D2A7999E234E33828888AD455BAA6AB101D90323579ABC1095B8C42F0F723B6F | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1804 | firefox.exe | POST | 200 | 216.58.206.67:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
1804 | firefox.exe | POST | 200 | 184.24.77.69:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
1804 | firefox.exe | POST | 200 | 216.58.206.67:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7148 | ProtonVPN.exe | POST | 200 | 96.126.124.158:80 | http://96.126.124.158/ | unknown | — | — | unknown |
7148 | ProtonVPN.exe | POST | 200 | 96.126.124.158:80 | http://96.126.124.158/ | unknown | — | — | unknown |
1804 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
1804 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 4.231.128.59:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
7148 | ProtonVPN.exe | 52.92.179.138:443 | barrysploitbucket.s3.us-west-2.amazonaws.com | AMAZON-02 | US | shared |
6544 | svchost.exe | 20.190.159.129:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | unknown |
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
barrysploitbucket.s3.us-west-2.amazonaws.com |
| shared |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
7148 | ProtonVPN.exe | Malware Command and Control Activity Detected | ET MALWARE Havoc Demon CnC Request |
2196 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] hCaptcha Enterprise Challenge |
2196 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] hCaptcha Enterprise Challenge |
2196 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] hCaptcha Enterprise Challenge |
2196 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] hCaptcha Enterprise Challenge |
2196 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] hCaptcha Enterprise Challenge |
7932 | ProtonVPN.exe | Malware Command and Control Activity Detected | ET MALWARE Havoc Demon CnC Request |