Malware analysis Proton VPN for Pc v1.16.1 + Working Crack [MultiLang].zip Malicious activity

Add for printing

File name:	Proton VPN for Pc v1.16.1 + Working Crack [MultiLang].zip
Full analysis:	https://app.any.run/tasks/ee6ab72c-bd74-4ee1-8b32-e81b0d6cb784
Verdict:	Malicious activity
Threats:	Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	August 02, 2024, 23:47:42
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	stealer
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract, compression method=store
MD5:	264959B80B382228227E86E788FEC8E5
SHA1:	67283030B400382590BD94BA682290C945CF5B60
SHA256:	E8669E5FFEFA8481E85FA444D918A95453DE7DA095EAFB180DEF2E724C72B80E
SSDEEP:	98304:U9hP6hQdNOncxvKotqxp7s37yJJ+IRKFcmk9o5Ry0Sc2jwLQognSkt/zP9BT1XhR:R4p49l4Or6Qc2D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - WinRAR.exe (PID: 6432)
- Actions looks like stealing of personal data
  - WinRAR.exe (PID: 6432)
  - ProtonVPN.exe (PID: 1784)
  - WerFault.exe (PID: 788)
SUSPICIOUS
- Executes application which crashes
  - ProtonVPN_win_v1.16.1.exe (PID: 3972)
  - ProtonVPN.exe (PID: 1784)
  - ProtonVPN_win_v1.16.1.exe (PID: 2228)
INFO
- Reads the computer name
  - ProtonVPN_win_v1.16.1.exe (PID: 3972)
  - ProtonVPN.exe (PID: 1784)
  - ProtonVPN_win_v1.16.1.exe (PID: 2228)
- Checks supported languages
  - ProtonVPN_win_v1.16.1.exe (PID: 3972)
  - ProtonVPN.exe (PID: 1784)
  - ProtonVPN_win_v1.16.1.exe (PID: 2228)
- Checks proxy server information
  - WerFault.exe (PID: 4296)
  - WerFault.exe (PID: 788)
  - WerFault.exe (PID: 7096)
- Manual execution by a user
  - ProtonVPN_win_v1.16.1.exe (PID: 3972)
  - ProtonVPN.exe (PID: 1784)
  - ProtonVPN_win_v1.16.1.exe (PID: 2228)
- Reads the software policy settings
  - WerFault.exe (PID: 4296)
  - WerFault.exe (PID: 788)
  - WerFault.exe (PID: 7096)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 6432)
- Creates files or folders in the user directory
  - WerFault.exe (PID: 4296)
  - WerFault.exe (PID: 788)
  - WerFault.exe (PID: 7096)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	-
ZipCompression:	None
ZipModifyDate:	2024:08:02 08:04:30
ZipCRC:	0x00000000
ZipCompressedSize:	-
ZipUncompressedSize:	-
ZipFileName:	Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]/

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

144

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

788

C:\WINDOWS\system32\WerFault.exe -u -p 1784 -s 588

C:\Windows\System32\WerFault.exe

ProtonVPN.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Problem Reporting

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll

1784

"C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\CRACK\ProtonVPN.exe"

C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\CRACK\ProtonVPN.exe

explorer.exe

User:

admin

Company:

Sobering digitisers

Integrity Level:

MEDIUM

Description:

Burliest smelled ordered

Exit code:

3221225725

Version:

2.71.65.1

Modules

Images
c:\users\admin\downloads\proton vpn for pc v1.16.1 + working crack [multilang]\crack\protonvpn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll

2228

"C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\ProtonVPN_win_v1.16.1.exe"

C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\ProtonVPN_win_v1.16.1.exe

explorer.exe

User:

admin

Company:

Sobering digitisers

Integrity Level:

MEDIUM

Description:

Burliest smelled ordered

Exit code:

3221225725

Version:

2.71.65.1

Modules

Images
c:\users\admin\downloads\proton vpn for pc v1.16.1 + working crack [multilang]\protonvpn_win_v1.16.1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

3972

"C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\ProtonVPN_win_v1.16.1.exe"

C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\ProtonVPN_win_v1.16.1.exe

explorer.exe

User:

admin

Company:

Sobering digitisers

Integrity Level:

MEDIUM

Description:

Burliest smelled ordered

Exit code:

3221225725

Version:

2.71.65.1

Modules

Images
c:\users\admin\downloads\proton vpn for pc v1.16.1 + working crack [multilang]\protonvpn_win_v1.16.1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll

4296

C:\WINDOWS\system32\WerFault.exe -u -p 3972 -s 596

C:\Windows\System32\WerFault.exe

ProtonVPN_win_v1.16.1.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Problem Reporting

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll

6320

C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Windows\System32\rundll32.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll

6432

"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang].zip"

C:\Program Files\WinRAR\WinRAR.exe

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Exit code:

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

7096

C:\WINDOWS\system32\WerFault.exe -u -p 2228 -s 560

C:\Windows\System32\WerFault.exe

ProtonVPN_win_v1.16.1.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Problem Reporting

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\cryptsp.dll

Add for printing

Total events

15 544

Read events

15 520

Write events

Delete events

Modification events


(PID) Process:	(6432) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(6432) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(6432) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:	(6432) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang].zip
(PID) Process:	(6432) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(6432) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(6432) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(6432) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100
(PID) Process:	(6432) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:	write	Name:	0
Value: C:\Users\admin\Downloads
(PID) Process:	(6432) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:	write	Name:	Placement
Value: 2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6432	WinRAR.exe	C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\CRACK\ProtonVPN.exe		executable
		MD5:5FEFCF76853566C0D4BC58EA47189C53	SHA256:9125C13250A14905A4FD97978A3A6DBBA80DF01E73D98F8D4FA2D19B49D9FDA0
6432	WinRAR.exe	C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\Screenshots\10.jpg		image
		MD5:6DA3BF3B896C5FADB10E3594CB46A36B	SHA256:2494F95AA1BEE94A848254FFAC7A45EDA07085DDDC894EB0A5EC21CA6CC5D7A9
6432	WinRAR.exe	C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\Read Me - Leggimi by JA.txt		text
		MD5:1B24B72BB0924D789C4B6480D40AD188	SHA256:45E745F3D8105D6701BE50A596400225AF3F837FAF6C8112C797A9D829529C4B
6432	WinRAR.exe	C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\Screenshots\12.jpg		image
		MD5:A5D3543FADF7849AD4829302394A5B5D	SHA256:6B9983F87FF2DEE0E8CE66902A7B3814E13C4741310A49D1FF3C6A8BBD36C9EA
6432	WinRAR.exe	C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\Screenshots\17.jpg		image
		MD5:006B39EA5C116A52CF935E5B6201050F	SHA256:1FC7CC9E434627B704E736BC15B8BEA0C2D5DD0CB053A2869300F422EBF376E8
6432	WinRAR.exe	C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\Screenshots\14.jpg		image
		MD5:7DE4D1CCC68D11FACA1F9E2C877A405E	SHA256:42A37A5CF8028D6293852566B2AE173DF90C6F8F283AEBADBB23FAEFD5F4DC86
6432	WinRAR.exe	C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\Screenshots\13.jpg		image
		MD5:A6031D7D0D158293862663411249BAB8	SHA256:0F5D2790B8CD7976B9A0AC813044D1C3223774A866EB35963C9AE29949E22776
6432	WinRAR.exe	C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\Screenshots\15.jpg		image
		MD5:7CE88D505D5AE9A5F27494A23988A2C3	SHA256:C2AF09FBA68540CD8A9878C8F3F3D2805F6710B34E00B5D13E2D4FE10B27B1D1
6432	WinRAR.exe	C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\Screenshots\19.jpg		image
		MD5:8BD46ADA88660BD21EBD18DC605A1395	SHA256:3F7C8B3C38DF8885AEED205B9ADB18AD3AB9429D8ECA60DD48FB8269E4CE7018
6432	WinRAR.exe	C:\Users\admin\Downloads\Proton VPN for Pc v1.16.1 + Working Crack [MultiLang]\Screenshots\1.jpg		image
		MD5:CD332709276FFA5E60F990D7A828A945	SHA256:428EE12C7A41C558F5EE221A7CE867564825E69473287ECF15192FCC1BEBB20D

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
4592	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6904	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6980	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
4780	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2120	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2044	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5336	SearchApp.exe	104.126.37.139:443	www.bing.com	Akamai International B.V.	DE	unknown
5336	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
4592	svchost.exe	20.190.159.4:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4592	svchost.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 4.231.128.59	whitelisted
google.com	142.250.185.238	whitelisted
www.bing.com	104.126.37.139 104.126.37.131 104.126.37.130 104.126.37.128 104.126.37.176 104.126.37.163 104.126.37.178 104.126.37.136 104.126.37.154	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	20.190.159.4 40.126.31.69 20.190.159.23 20.190.159.0 20.190.159.2 40.126.31.71 20.190.159.64 40.126.31.67	whitelisted
client.wns.windows.com	40.113.110.67	whitelisted
th.bing.com	104.126.37.131 104.126.37.128 104.126.37.136 104.126.37.154 104.126.37.139 104.126.37.130 104.126.37.163 104.126.37.178 104.126.37.176	whitelisted
fd.api.iris.microsoft.com	20.199.58.43	whitelisted
arc.msn.com	20.223.36.55	whitelisted
watson.events.data.microsoft.com	104.208.16.94 20.42.73.29	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

Proton VPN for Pc v1.16.1 + Working Crack [MultiLang].zip

264959B80B382228227E86E788FEC8E5

67283030B400382590BD94BA682290C945CF5B60

E8669E5FFEFA8481E85FA444D918A95453DE7DA095EAFB180DEF2E724C72B80E

98304:U9hP6hQdNOncxvKotqxp7s37yJJ+IRKFcmk9o5Ry0Sc2jwLQognSkt/zP9BT1XhR:R4p49l4Or6Qc2D

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Actions looks like stealing of personal data

SUSPICIOUS

Executes application which crashes

INFO

Reads the computer name

Checks supported languages

Checks proxy server information

Manual execution by a user

Reads the software policy settings

Executable content was dropped or overwritten

Creates files or folders in the user directory

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings