File name: | ProtonVPN_win_v1.9.2.exe |
Full analysis: | https://app.any.run/tasks/3cb7fad8-b357-4d79-b6a6-3dcd10195099 |
Verdict: | Malicious activity |
Analysis date: | August 25, 2019, 16:40:41 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 5AF9C9EEBE0448C36948C26EA0CDD014 |
SHA1: | C9EFDC1A0CB0CBBAC777D02E58097E34546BCACE |
SHA256: | B3EED41D100C32700E48B7A365CBC22E7AEE78A0E62C53D58E5B02771BB8776B |
SSDEEP: | 196608:km6D7i1Zytcya/Bj7TYqDA9UQzkK3Gi2OQhEdbFxu4V1hPw5Ehp:kmE21ZytcyqjxK9ruCPbQEhp |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
ProductVersion: | 1.9.2 |
---|---|
ProductName: | ProtonVPN |
OriginalFileName: | ProtonVPN_win_v1.9.2.exe |
LegalCopyright: | Copyright (C) 2019 ProtonVPN AG |
InternalName: | ProtonVPN_win_v1.9.2 |
FileVersion: | 1.9.2 |
FileDescription: | ProtonVPN Installer |
CompanyName: | ProtonVPN AG |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Dynamic link library |
FileOS: | Win32 |
FileFlags: | Debug |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 1.9.2.0 |
FileVersionNumber: | 1.9.2.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 6 |
ImageVersion: | - |
OSVersion: | 6 |
EntryPoint: | 0x11e2e0 |
UninitializedDataSize: | - |
InitializedDataSize: | 599040 |
CodeSize: | 1502720 |
LinkerVersion: | 14.2 |
PEType: | PE32 |
TimeStamp: | 2019:05:28 16:44:42+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 28-May-2019 14:44:42 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | ProtonVPN AG |
FileDescription: | ProtonVPN Installer |
FileVersion: | 1.9.2 |
InternalName: | ProtonVPN_win_v1.9.2 |
LegalCopyright: | Copyright (C) 2019 ProtonVPN AG |
OriginalFileName: | ProtonVPN_win_v1.9.2.exe |
ProductName: | ProtonVPN |
ProductVersion: | 1.9.2 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000118 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 28-May-2019 14:44:42 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0016ECBF | 0x0016EE00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.44009 |
.rdata | 0x00170000 | 0x0005E6EC | 0x0005E800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.60441 |
.data | 0x001CF000 | 0x00007134 | 0x00005400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.10576 |
.rsrc | 0x001D7000 | 0x0001539C | 0x00015400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.79993 |
.reloc | 0x001ED000 | 0x00019324 | 0x00019400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.55544 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.18998 | 1909 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 5.2982 | 2440 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 5.19797 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 4.93168 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 7.96069 | 17118 | Latin 1 / Western European | English - United States | RT_ICON |
9 | 3.37783 | 1116 | Latin 1 / Western European | English - United States | RT_STRING |
10 | 3.35254 | 1888 | Latin 1 / Western European | English - United States | RT_STRING |
11 | 3.31743 | 760 | Latin 1 / Western European | English - United States | RT_STRING |
12 | 3.23118 | 1432 | Latin 1 / Western European | English - United States | RT_STRING |
13 | 3.35766 | 820 | Latin 1 / Western European | English - United States | RT_STRING |
KERNEL32.dll |
msi.dll (delay-loaded) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3496 | "C:\Users\admin\AppData\Local\Temp\ProtonVPN_win_v1.9.2.exe" | C:\Users\admin\AppData\Local\Temp\ProtonVPN_win_v1.9.2.exe | — | explorer.exe |
User: admin Company: ProtonVPN AG Integrity Level: MEDIUM Description: ProtonVPN Installer Exit code: 3221226540 Version: 1.9.2 | ||||
2876 | "C:\Users\admin\AppData\Local\Temp\ProtonVPN_win_v1.9.2.exe" | C:\Users\admin\AppData\Local\Temp\ProtonVPN_win_v1.9.2.exe | explorer.exe | |
User: admin Company: ProtonVPN AG Integrity Level: HIGH Description: ProtonVPN Installer Version: 1.9.2 | ||||
2788 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
2488 | C:\Windows\system32\MsiExec.exe -Embedding 49D0037DB6A7995E911CA560325E8176 C | C:\Windows\system32\MsiExec.exe | — | msiexec.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) | ||||
3128 | cmd /c ""C:\Users\admin\AppData\Local\Temp\{1F53C2A4-3E2E-4874-BD05-12DC99ED7681}\check-KB3033929.bat" " | C:\Windows\system32\cmd.exe | — | ProtonVPN_win_v1.9.2.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
3824 | wmic qfe where "HotFixID = 'KB3033929'" | C:\Windows\System32\Wbem\WMIC.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3992 | Find "KB3033929" | C:\Windows\system32\find.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Find String (grep) Utility Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3420 | "C:\Windows\system32\wusa.exe" "C:\Users\admin\AppData\Roaming\ProtonVPN AG\ProtonVPN\prerequisites\Windows6.1-KB3033929-x86.msu" | C:\Windows\system32\wusa.exe | ProtonVPN_win_v1.9.2.exe | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Update Standalone Installer Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2504 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3412 | DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot22" "" "" "695c3f483" "00000000" "000004B8" "000005B8" | C:\Windows\system32\DrvInst.exe | — | svchost.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2876) ProtonVPN_win_v1.9.2.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2876) ProtonVPN_win_v1.9.2.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE |
Operation: | write | Name: | Blob |
Value: 0F0000000100000014000000F53631B5177626EB6541DF5563C8187D9DCA421A09000000010000005E000000305C06082B0601050507030306082B0601050507030106082B0601050507030206082B0601050507030406082B0601050508020206082B0601050507030606082B0601050507030706082B06010505070308060A2B0601040182370A030453000000010000002400000030223020060A6086480186FA6C0A010230123010060A2B0601040182373C0101030200C014000000010000001400000055E481D11180BED889B908A331F9A1240916B9701D0000000100000010000000E871723E266F38AF5D49CDA2A502669C0B000000010000001000000045006E00740072007500730074000000030000000100000014000000801D62D07B449D5C5C035C98EA61FA443C2A58FE2000000001000000600400003082045C30820344A00302010202043863B966300D06092A864886F70D01010505003081B431143012060355040A130B456E74727573742E6E65743140303E060355040B14377777772E656E74727573742E6E65742F4350535F3230343820696E636F72702E206279207265662E20286C696D697473206C6961622E2931253023060355040B131C286329203139393920456E74727573742E6E6574204C696D69746564313330310603550403132A456E74727573742E6E65742043657274696669636174696F6E20417574686F7269747920283230343829301E170D3939313232343137353035315A170D3139313232343138323035315A3081B431143012060355040A130B456E74727573742E6E65743140303E060355040B14377777772E656E74727573742E6E65742F4350535F3230343820696E636F72702E206279207265662E20286C696D697473206C6961622E2931253023060355040B131C286329203139393920456E74727573742E6E6574204C696D69746564313330310603550403132A456E74727573742E6E65742043657274696669636174696F6E20417574686F726974792028323034382930820122300D06092A864886F70D01010105000382010F003082010A0282010100AD4D4BA91286B2EAA320071516642A2B4BD1BF0B4A4D8EED8076A567B77840C07342C868C0DB532BDD5EB8769835938B1A9D7C133A0E1F5BB71ECFE524141EB181A98D7DB8CC6B4B03F1020CDCABA54024007F7494A19D0829B3880BF587779D55CDE4C37ED76A64AB851486955B9732506F3DC8BA660CE3FCBDB849C176894919FDC0A8BD89A3672FC69FBC711960B82DE92CC99076667B94E2AF78D665535D3CD69CB2CF2903F92FA450B2D448CE0532558AFDB2644C0EE4980775DB7FDFB9085560853029F97B48A46986E3353F1E865D7A7A15BDEF008E1522541700902693BC0E496891BFF847D39D9542C10E4DDF6F26CFC3182162664370D6D5C007E10203010001A3743072301106096086480186F8420101040403020007301F0603551D2304183016801455E481D11180BED889B908A331F9A1240916B970301D0603551D0E0416041455E481D11180BED889B908A331F9A1240916B970301D06092A864886F67D0741000410300E1B0856352E303A342E3003020490300D06092A864886F70D010105050003820101005947AC21848A17C99C89531EBA80851AC63C4E3EB19CB67CC6925D186402E3D3060811617C63E32B9D31037076D2A328A0F4BB9A6373ED6DE52ADBED14A92BC63611D02BEB078BA5DA9E5C199D5612F55429C805EDB2122A8DF4031BFFE7921087B03AB5C39D053712A3C7F415B9D5A439169B533A2391F1A882A26A8868C1790222BCAAA6D6AEDFB0145FB887D0DD7C7F7BFFAF1CCFE6DB07AD5EDB859DD02B0D33DB04D1E64940132B76FB3EE99C890F15CE18B08578214F6B4F0EFA3667CD07F2FF08D0E2DED9BF2AAFB88786213C04CAB794687FCF3CE998D738FFECC0D950F02E4B58AE466FD02EC360DA725572BD4C459E61BABF84819203D1D2697CC5 | |||
(PID) Process: | (2876) ProtonVPN_win_v1.9.2.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE |
Operation: | write | Name: | Blob |
Value: 040000000100000010000000BA21EA20D6DDDB8FC1578B40ADA1FCFC030000000100000014000000801D62D07B449D5C5C035C98EA61FA443C2A58FE0B000000010000001000000045006E007400720075007300740000001D0000000100000010000000E871723E266F38AF5D49CDA2A502669C14000000010000001400000055E481D11180BED889B908A331F9A1240916B97053000000010000002400000030223020060A6086480186FA6C0A010230123010060A2B0601040182373C0101030200C009000000010000005E000000305C06082B0601050507030306082B0601050507030106082B0601050507030206082B0601050507030406082B0601050508020206082B0601050507030606082B0601050507030706082B06010505070308060A2B0601040182370A03040F0000000100000014000000F53631B5177626EB6541DF5563C8187D9DCA421A2000000001000000600400003082045C30820344A00302010202043863B966300D06092A864886F70D01010505003081B431143012060355040A130B456E74727573742E6E65743140303E060355040B14377777772E656E74727573742E6E65742F4350535F3230343820696E636F72702E206279207265662E20286C696D697473206C6961622E2931253023060355040B131C286329203139393920456E74727573742E6E6574204C696D69746564313330310603550403132A456E74727573742E6E65742043657274696669636174696F6E20417574686F7269747920283230343829301E170D3939313232343137353035315A170D3139313232343138323035315A3081B431143012060355040A130B456E74727573742E6E65743140303E060355040B14377777772E656E74727573742E6E65742F4350535F3230343820696E636F72702E206279207265662E20286C696D697473206C6961622E2931253023060355040B131C286329203139393920456E74727573742E6E6574204C696D69746564313330310603550403132A456E74727573742E6E65742043657274696669636174696F6E20417574686F726974792028323034382930820122300D06092A864886F70D01010105000382010F003082010A0282010100AD4D4BA91286B2EAA320071516642A2B4BD1BF0B4A4D8EED8076A567B77840C07342C868C0DB532BDD5EB8769835938B1A9D7C133A0E1F5BB71ECFE524141EB181A98D7DB8CC6B4B03F1020CDCABA54024007F7494A19D0829B3880BF587779D55CDE4C37ED76A64AB851486955B9732506F3DC8BA660CE3FCBDB849C176894919FDC0A8BD89A3672FC69FBC711960B82DE92CC99076667B94E2AF78D665535D3CD69CB2CF2903F92FA450B2D448CE0532558AFDB2644C0EE4980775DB7FDFB9085560853029F97B48A46986E3353F1E865D7A7A15BDEF008E1522541700902693BC0E496891BFF847D39D9542C10E4DDF6F26CFC3182162664370D6D5C007E10203010001A3743072301106096086480186F8420101040403020007301F0603551D2304183016801455E481D11180BED889B908A331F9A1240916B970301D0603551D0E0416041455E481D11180BED889B908A331F9A1240916B970301D06092A864886F67D0741000410300E1B0856352E303A342E3003020490300D06092A864886F70D010105050003820101005947AC21848A17C99C89531EBA80851AC63C4E3EB19CB67CC6925D186402E3D3060811617C63E32B9D31037076D2A328A0F4BB9A6373ED6DE52ADBED14A92BC63611D02BEB078BA5DA9E5C199D5612F55429C805EDB2122A8DF4031BFFE7921087B03AB5C39D053712A3C7F415B9D5A439169B533A2391F1A882A26A8868C1790222BCAAA6D6AEDFB0145FB887D0DD7C7F7BFFAF1CCFE6DB07AD5EDB859DD02B0D33DB04D1E64940132B76FB3EE99C890F15CE18B08578214F6B4F0EFA3667CD07F2FF08D0E2DED9BF2AAFB88786213C04CAB794687FCF3CE998D738FFECC0D950F02E4B58AE466FD02EC360DA725572BD4C459E61BABF84819203D1D2697CC5 | |||
(PID) Process: | (2876) ProtonVPN_win_v1.9.2.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\801D62D07B449D5C5C035C98EA61FA443C2A58FE |
Operation: | write | Name: | Blob |
Value: 19000000010000001000000091FAD483F14848A8A69B18B805CDBB3A0F0000000100000014000000F53631B5177626EB6541DF5563C8187D9DCA421A09000000010000005E000000305C06082B0601050507030306082B0601050507030106082B0601050507030206082B0601050507030406082B0601050508020206082B0601050507030606082B0601050507030706082B06010505070308060A2B0601040182370A030453000000010000002400000030223020060A6086480186FA6C0A010230123010060A2B0601040182373C0101030200C014000000010000001400000055E481D11180BED889B908A331F9A1240916B9701D0000000100000010000000E871723E266F38AF5D49CDA2A502669C0B000000010000001000000045006E00740072007500730074000000030000000100000014000000801D62D07B449D5C5C035C98EA61FA443C2A58FE040000000100000010000000BA21EA20D6DDDB8FC1578B40ADA1FCFC2000000001000000600400003082045C30820344A00302010202043863B966300D06092A864886F70D01010505003081B431143012060355040A130B456E74727573742E6E65743140303E060355040B14377777772E656E74727573742E6E65742F4350535F3230343820696E636F72702E206279207265662E20286C696D697473206C6961622E2931253023060355040B131C286329203139393920456E74727573742E6E6574204C696D69746564313330310603550403132A456E74727573742E6E65742043657274696669636174696F6E20417574686F7269747920283230343829301E170D3939313232343137353035315A170D3139313232343138323035315A3081B431143012060355040A130B456E74727573742E6E65743140303E060355040B14377777772E656E74727573742E6E65742F4350535F3230343820696E636F72702E206279207265662E20286C696D697473206C6961622E2931253023060355040B131C286329203139393920456E74727573742E6E6574204C696D69746564313330310603550403132A456E74727573742E6E65742043657274696669636174696F6E20417574686F726974792028323034382930820122300D06092A864886F70D01010105000382010F003082010A0282010100AD4D4BA91286B2EAA320071516642A2B4BD1BF0B4A4D8EED8076A567B77840C07342C868C0DB532BDD5EB8769835938B1A9D7C133A0E1F5BB71ECFE524141EB181A98D7DB8CC6B4B03F1020CDCABA54024007F7494A19D0829B3880BF587779D55CDE4C37ED76A64AB851486955B9732506F3DC8BA660CE3FCBDB849C176894919FDC0A8BD89A3672FC69FBC711960B82DE92CC99076667B94E2AF78D665535D3CD69CB2CF2903F92FA450B2D448CE0532558AFDB2644C0EE4980775DB7FDFB9085560853029F97B48A46986E3353F1E865D7A7A15BDEF008E1522541700902693BC0E496891BFF847D39D9542C10E4DDF6F26CFC3182162664370D6D5C007E10203010001A3743072301106096086480186F8420101040403020007301F0603551D2304183016801455E481D11180BED889B908A331F9A1240916B970301D0603551D0E0416041455E481D11180BED889B908A331F9A1240916B970301D06092A864886F67D0741000410300E1B0856352E303A342E3003020490300D06092A864886F70D010105050003820101005947AC21848A17C99C89531EBA80851AC63C4E3EB19CB67CC6925D186402E3D3060811617C63E32B9D31037076D2A328A0F4BB9A6373ED6DE52ADBED14A92BC63611D02BEB078BA5DA9E5C199D5612F55429C805EDB2122A8DF4031BFFE7921087B03AB5C39D053712A3C7F415B9D5A439169B533A2391F1A882A26A8868C1790222BCAAA6D6AEDFB0145FB887D0DD7C7F7BFFAF1CCFE6DB07AD5EDB859DD02B0D33DB04D1E64940132B76FB3EE99C890F15CE18B08578214F6B4F0EFA3667CD07F2FF08D0E2DED9BF2AAFB88786213C04CAB794687FCF3CE998D738FFECC0D950F02E4B58AE466FD02EC360DA725572BD4C459E61BABF84819203D1D2697CC5 | |||
(PID) Process: | (2876) ProtonVPN_win_v1.9.2.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD |
Operation: | write | Name: | Blob |
Value: 040000000100000010000000C5DFB849CA051355EE2DBA1AC33EB0280F00000001000000200000005229BA15B31B0C6F4CCA89C2985177974327D1B689A3B935A0BD975532AF22AB090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030306082B0601050507030406082B06010505070308060A2B0601040182370A030406082B0601050507030606082B060105050703070B000000010000003000000047006C006F00620061006C005300690067006E00200052006F006F00740020004300410020002D0020005200330000005300000001000000230000003021301F06092B06010401A032010130123010060A2B0601040182373C0101030200C0620000000100000020000000CBB522D7B7F127AD6A0113865BDF1CD4102E7D0759AF635A7CF4720DC963C53B1400000001000000140000008FF04B7FA82E4524AE4D50FA639A8BDEE2DD1BBC1D000000010000001000000001728E1ECF7A9D86FB3CEC8948ABA953030000000100000014000000D69B561148F01C77C54578C10926DF5B856976AD190000000100000010000000D0FD3C9C380D7B65E26B9A3FEDD39B8F2000000001000000630300003082035F30820247A003020102020B04000000000121585308A2300D06092A864886F70D01010B0500304C3120301E060355040B1317476C6F62616C5369676E20526F6F74204341202D20523331133011060355040A130A476C6F62616C5369676E311330110603550403130A476C6F62616C5369676E301E170D3039303331383130303030305A170D3239303331383130303030305A304C3120301E060355040B1317476C6F62616C5369676E20526F6F74204341202D20523331133011060355040A130A476C6F62616C5369676E311330110603550403130A476C6F62616C5369676E30820122300D06092A864886F70D01010105000382010F003082010A0282010100CC2576907906782216F5C083B684CA289EFD057611C5AD8872FC460243C7B28A9D045F24CB2E4BE1608246E152AB0C8147706CDD64D1EBF52CA30F823D0C2BAE97D7B614861079BB3B1380778C08E149D26A622F1F5EFA9668DF892795389F06D73EC9CB26590D73DEB0C8E9260E8315C6EF5B8BD20460CA49A628F6693BF6CBC82891E59D8A615737AC7414DC74E03AEE722F2E9CFBD0BBBFF53D00E10633E8822BAE53A63A16738CDD410E203AC0B4A7A1E9B24F902E3260E957CBB904926868E538266075B29F77FF9114EFAE2049FCAD401548D1023161195EB897EFAD77B7649A7ABF5FC113EF9B62FB0D6CE0546916A903DA6EE983937176C6698582170203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E041604148FF04B7FA82E4524AE4D50FA639A8BDEE2DD1BBC300D06092A864886F70D01010B050003820101004B40DBC050AAFEC80CEFF796544549BB96000941ACB3138686280733CA6BE674B9BA002DAEA40AD3F5F1F10F8ABF73674A83C7447B78E0AF6E6C6F03298E333945C38EE4B9576CAAFC1296EC53C62DE4246CB99463FBDC536867563E83B8CF3521C3C968FECEDAC253AACC908AE9F05D468C95DD7A58281A2F1DDECD0037418FED446DD75328977EF367041E15D78A96B4D3DE4C27A44C1B737376F41799C21F7A0EE32D08AD0A1C2CFF3CAB550E0F917E36EBC35749BEE12E2D7C608BC3415113239DCEF7326B9401A899E72C331F3A3B25D28640CE3B2C8678C9612F14BAEEDB556FDF84EE05094DBD28D872CED36250651EEB92978331D9B3B5CA47583F5F | |||
(PID) Process: | (2876) ProtonVPN_win_v1.9.2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2876) ProtonVPN_win_v1.9.2.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2876) ProtonVPN_win_v1.9.2.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ProtonVPN_win_v1_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (2876) ProtonVPN_win_v1.9.2.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ProtonVPN_win_v1_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (2876) ProtonVPN_win_v1.9.2.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\ProtonVPN_win_v1_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: 4294901760 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2876 | ProtonVPN_win_v1.9.2.exe | C:\Users\admin\AppData\Local\Temp\{1F53C2A4-3E2E-4874-BD05-12DC99ED7681}\holder0.aiph | — | |
MD5:— | SHA256:— | |||
2876 | ProtonVPN_win_v1.9.2.exe | C:\Users\admin\AppData\Local\Temp\{1F53C2A4-3E2E-4874-BD05-12DC99ED7681}\9ED7681\ProtonVPN_win_v1.9.2.msi | — | |
MD5:— | SHA256:— | |||
2876 | ProtonVPN_win_v1.9.2.exe | C:\Users\admin\AppData\Local\Temp\MSIB701.tmp | — | |
MD5:— | SHA256:— | |||
2876 | ProtonVPN_win_v1.9.2.exe | C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_2876\TapInstaller.CA.dll | executable | |
MD5:1964558DDBB34909FAD45549B34FAF22 | SHA256:5DFD17E901FD1E0AB21C01324708214F2D3A94E5AABD88D65417551643783570 | |||
2876 | ProtonVPN_win_v1.9.2.exe | C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_2876\custicon | image | |
MD5:3EAEBDADE778394F06B29659C9C01ED7 | SHA256:719E644C31D0CC6B891F6A1253655DFBA39A3B78E06D24817BE1D8492B172B48 | |||
2876 | ProtonVPN_win_v1.9.2.exe | C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_2876\removico | image | |
MD5:20D25E871A244B94574C47726DE745D6 | SHA256:88DD7EE9FA22ECDBDC6B3D47DB83BC3D72360AEB43588E6A9A008B224389CB1C | |||
2876 | ProtonVPN_win_v1.9.2.exe | C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_2876\Up | image | |
MD5:83730AC00391FB0F02F56FE2E4207A10 | SHA256:573E3260EED63604F24F6F10CE5294E25E22FDA9E5BFD9010134DE6E684BAB98 | |||
2876 | ProtonVPN_win_v1.9.2.exe | C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_2876\info | image | |
MD5:554FF4C199562515D758C9ABFF5C2943 | SHA256:9AE4A96BF2A349667E844ACC1E2AC4F89361A6182268438F4D063DF3A6FC47BC | |||
2876 | ProtonVPN_win_v1.9.2.exe | C:\Users\admin\AppData\Local\Temp\{1F53C2A4-3E2E-4874-BD05-12DC99ED7681}\decoder.dll | executable | |
MD5:5371AE6B781F0565E209B871644D2184 | SHA256:C23FCB6D9CBBD0D999465F284766BC41C7F1127FBAB2ABEABE57B5A41E1AB2E0 | |||
2876 | ProtonVPN_win_v1.9.2.exe | C:\Users\admin\AppData\Local\Temp\AI_EXTUI_BIN_2876\aicustact.dll | executable | |
MD5:C18BC0B736979D22EEB22085D2023D28 | SHA256:2646D5432FF0B4EC3E39E21F4CF250BC80E6AF01F2466EC97A21C4026D1958D9 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2876 | ProtonVPN_win_v1.9.2.exe | 2.18.233.19:443 | download.microsoft.com | Akamai International B.V. | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
download.microsoft.com |
| whitelisted |