Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
07-08-2021 17:18
Static task
static1
Behavioral task
behavioral1
Sample
Express Vpn Cracked.exe
Resource
win7v20210410
General
-
Target
Express Vpn Cracked.exe
-
Size
36.3MB
-
MD5
4544b2f40af00c61376c030f0e102d98
-
SHA1
05824e0ec140e56fb066f7fffbcd79b6dadfdbf1
-
SHA256
5ee49e2433a68b616317e190b5a53840e58455dfccda71e4b9f6e727a3b7a7fd
-
SHA512
785ee454b9ae81714241ee7df9fa38e6e5e5f7a377e4ebff6d33fdf86b51b3805f13ecb0a2cdf5e24be06ebe17d3d7dd349be83bb005284d56305475654220a0
Malware Config
Extracted
njrat
0.7d
happy
alcachofa724-46937.portmap.host:46937
b2cfa0ba1b27be996957c11e1bf6a214
-
reg_key
b2cfa0ba1b27be996957c11e1bf6a214
-
splitter
|'|'|
Signatures
-
Poullight Stealer Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Cpecf.exe family_poullight C:\Users\Admin\AppData\Local\Temp\Cpecf.exe family_poullight -
Registers COM server for autorun 1 TTPs
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 416 created 3172 416 WerFault.exe Cpecf.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
svchost.exedescription pid process target process PID 4752 created 2756 4752 svchost.exe Xlpzxnsnafub.exe PID 4752 created 2756 4752 svchost.exe Xlpzxnsnafub.exe -
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
-
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
-
Blocklisted process makes network request 5 IoCs
Processes:
msiexec.exeflow pid process 29 4192 msiexec.exe 31 4192 msiexec.exe 33 4192 msiexec.exe 35 4192 msiexec.exe 37 4192 msiexec.exe -
Executes dropped EXE 9 IoCs
Processes:
Actg.exeCpecf.exeXlpzxnsnafub.exeXlpzxnsnafub.exewindowsupdate.exeExpressVPN_10.4.1.2.exeExpressVPN.exeExpressVPNNotificationService.exeExpressVPNNotificationService.exepid process 768 Actg.exe 3172 Cpecf.exe 3940 Xlpzxnsnafub.exe 2756 Xlpzxnsnafub.exe 2324 windowsupdate.exe 4084 ExpressVPN_10.4.1.2.exe 4796 ExpressVPN.exe 4816 ExpressVPNNotificationService.exe 4688 ExpressVPNNotificationService.exe -
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ExpressVPN.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation ExpressVPN.exe -
Drops startup file 2 IoCs
Processes:
windowsupdate.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2cfa0ba1b27be996957c11e1bf6a214.exe windowsupdate.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2cfa0ba1b27be996957c11e1bf6a214.exe windowsupdate.exe -
Loads dropped DLL 64 IoCs
Processes:
Xlpzxnsnafub.exeMsiExec.exerundll32.exerundll32.exeMsiExec.exerundll32.exerundll32.exepid process 2756 Xlpzxnsnafub.exe 2756 Xlpzxnsnafub.exe 2756 Xlpzxnsnafub.exe 2756 Xlpzxnsnafub.exe 2756 Xlpzxnsnafub.exe 2756 Xlpzxnsnafub.exe 2756 Xlpzxnsnafub.exe 2756 Xlpzxnsnafub.exe 2756 Xlpzxnsnafub.exe 4448 MsiExec.exe 4508 rundll32.exe 4508 rundll32.exe 4508 rundll32.exe 4508 rundll32.exe 4508 rundll32.exe 4508 rundll32.exe 4508 rundll32.exe 4508 rundll32.exe 4508 rundll32.exe 4508 rundll32.exe 4508 rundll32.exe 4448 MsiExec.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4664 rundll32.exe 4448 MsiExec.exe 4856 MsiExec.exe 4856 MsiExec.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4936 rundll32.exe 4856 MsiExec.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe 5112 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
windowsupdate.exeExpressVPN_10.4.1.2.exemsiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b2cfa0ba1b27be996957c11e1bf6a214 = "\"C:\\Users\\Admin\\windowsupdate.exe\" .." windowsupdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ExpressVPN_10.4.1.2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{336616d6-abef-4ff8-9afd-43ceb249ff9a} = "\"C:\\ProgramData\\Package Cache\\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\\ExpressVPN_10.4.1.2.exe\" /burn.runonce" ExpressVPN_10.4.1.2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ExpressVPNNotificationService = "\"C:\\Program Files (x86)\\ExpressVPN\\expressvpn-ui\\ExpressVPNNotificationServiceStarter.exe\"" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\b2cfa0ba1b27be996957c11e1bf6a214 = "\"C:\\Users\\Admin\\windowsupdate.exe\" .." windowsupdate.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exerundll32.exedescription ioc process File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\System.Runtime.InteropServices.RuntimeInformation.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN-Installer.exe msiexec.exe File created C:\Program Files (x86)\ExpressVPN\wintun\driver\amd64\expressvpn-wintun.sys msiexec.exe File created C:\Program Files (x86)\ExpressVPN\splittunnel\expressvpnsplittunnel.cat msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\com.expressvpn.helper.firefox.json msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\ExpressVPN.SplitTunnel.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\expressvpnd.exe msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\Sentry.PlatformAbstractions.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\Sentry.Protocol.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVpn.Client.Utils.NamedPipes.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\tap\driver\amd64\OemVista.inf msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\RasUtility.exe msiexec.exe File created C:\Program Files (x86)\ExpressVPN\tap\driver\amd64\tapexpressvpn.cat msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\44x44Logo.scale-200.png msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\ExpressVPN.Utils.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Management.Automation.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\44x44Logo.scale-400.png msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\RasUtility.exe.config msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\System.Management.Automation.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\XvUtil.exe msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\70x70Logo.scale-150.png msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ManagedWifi.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\tap\driver\amd64\tapexpressvpn.sys msiexec.exe File opened for modification C:\Program Files (x86)\ExpressVPN\expressvpnd\com.expressvpn.helper.json rundll32.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\150x150Logo.scale-100.png msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\44x44Logo.scale-150.png msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Caliburn.Micro.Platform.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\log4net.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\ManagedWifi.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Reactive.Core.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Runtime.InteropServices.RuntimeInformation.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\70x70Logo.scale-100.png msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Common.Logging.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\ExpressVPN.FilterManager.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\libxvclient.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Sentry.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Reactive.Interfaces.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\44x44Logo.scale-125.png msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\70x70Logo.scale-400.png msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\HtmlAgilityPack.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\lightway.exe msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\Common.Logging.Log4Net1213.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\ExpressVPN.NetworkUtils.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\Newtonsoft.Json.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\Sentry.dll msiexec.exe File opened for modification C:\Program Files (x86)\ExpressVPN\expressvpnd\com.expressvpn.helper.firefox.json rundll32.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\libpkcs11-helper-1.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Reactive.Windows.Threading.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\System.Runtime.InteropServices.RuntimeInformation.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\DotRas.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\ExpressVpn.Utils.Wmi.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\MissingLinq.Linq2Management.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\MissingLinq.Linq2Management.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN.exe msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN-Installer.exe.config msiexec.exe File created C:\Program Files (x86)\ExpressVPN\wintun\driver\amd64\expressvpn-wintun.inf msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Hardcodet.Wpf.TaskbarNotification.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\Sentry.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\bootstrap\amd64\nssm.exe msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\System.Reactive.Interfaces.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Windows.Interactivity.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Common.Logging.Log4Net1213.dll msiexec.exe File created C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\System.Reactive.Interfaces.dll msiexec.exe -
Drops file in Windows directory 64 IoCs
Processes:
rundll32.exemsiexec.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription ioc process File opened for modification C:\Windows\Installer\MSI61D0.tmp-\MissingLinq.Linq2Management.dll rundll32.exe File opened for modification C:\Windows\Installer\f753104.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI38B4.tmp-\ManagedWifi.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\ExpressVPN.Utils.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\System.Management.Automation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4FDB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5A6C.tmp-\ExpressVPN.Client.Installer.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5A6C.tmp-\Sentry.PlatformAbstractions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\ExpressVpn.Utils.Wmi.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\Sentry.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6637.tmp-\Sentry.PlatformAbstractions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI38B4.tmp-\Newtonsoft.Json.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\WixSharp Setup.pdb rundll32.exe File opened for modification C:\Windows\Installer\MSI5A6C.tmp-\WixSharp Setup.exe rundll32.exe File opened for modification C:\Windows\Installer\MSI5A6C.tmp-\System.Reactive.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI38B4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI38B4.tmp-\Sentry.PlatformAbstractions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\WixSharp Setup.pdb rundll32.exe File opened for modification C:\Windows\Installer\MSI61D0.tmp-\System.Reactive.Linq.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6637.tmp-\Common.Logging.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI38B4.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\Common.Logging.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\System.Reactive.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5A6C.tmp-\System.Management.Automation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6637.tmp-\System.Reactive.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI38B4.tmp-\System.Management.Automation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\Common.Logging.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\log4net.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\System.ValueTuple.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6637.tmp-\ManagedWifi.dll rundll32.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI38B4.tmp-\System.Reactive.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\System.Reactive.Core.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\WixSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5A6C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI61D0.tmp-\System.Reactive.Interfaces.dll rundll32.exe File created C:\Windows\Installer\SourceHash{E5B9C3E5-889C-4F22-A959-F4B8760D8833} msiexec.exe File opened for modification C:\Windows\Installer\MSI5A6C.tmp-\Common.Logging.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6637.tmp-\ExpressVPN.Client.Installer.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6637.tmp-\System.Reactive.Interfaces.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\Sentry.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\MissingLinq.Linq2Management.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5A6C.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI5A6C.tmp-\log4net.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI61D0.tmp-\System.ValueTuple.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6637.tmp-\WixSharp Setup.exe rundll32.exe File opened for modification C:\Windows\Installer\MSI6637.tmp-\log4net.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI38B4.tmp-\log4net.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\Sentry.Protocol.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\System.Reactive.Linq.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI38B4.tmp-\Sentry.Protocol.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\WixSharp Setup.exe rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\WixSharp Setup.exe rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI61D0.tmp-\System.Management.Automation.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI6637.tmp-\Sentry.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4344.tmp-\Sentry.PlatformAbstractions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4A3C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\Common.Logging.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\log4net.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55B8.tmp-\System.ValueTuple.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5A6C.tmp-\WixSharp Setup.pdb rundll32.exe File opened for modification C:\Windows\Installer\MSI6637.tmp-\CustomAction.config rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 416 3172 WerFault.exe Cpecf.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe -
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe -
Modifies registry class 51 IoCs
Processes:
msiexec.exeExpressVPN_10.4.1.2.exeExpressVPNNotificationService.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\ProductName = "ExpressVPN" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a} ExpressVPN_10.4.1.2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\ = "{336616d6-abef-4ff8-9afd-43ceb249ff9a}" ExpressVPN_10.4.1.2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E3C9B5EC98822F49A954F8B67D08833\Complete msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\shell\open\command\ = "\"C:\\Program Files (x86)\\ExpressVPN\\expressvpn-ui\\ExpressVPN.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E3C9B5EC98822F49A954F8B6DDC8703 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\ = "{E5B9C3E5-889C-4F22-A959-F4B8760D8833}" ExpressVPN_10.4.1.2.exe Key created \REGISTRY\MACHINE\Software\Classes\expressvpn\DefaultIcon msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\expressvpn\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\shell\open msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node\CLSID\{3e705353-af85-4ad9-9750-7fb07347eb98}\LocalServer32 ExpressVPNNotificationService.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node ExpressVPNNotificationService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\DisplayName = "ExpressVPN" ExpressVPN_10.4.1.2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\PackageName = "ExpressVPN.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833} ExpressVPN_10.4.1.2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\PackageCode = "7E9ECFB1B49175149997F02C809CF213" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E3C9B5EC98822F49A954F8B6DDC8703\5E3C9B5EC98822F49A954F8B67D08833 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\DisplayName = "ExpressVPN" ExpressVPN_10.4.1.2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\Dependents ExpressVPN_10.4.1.2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\Dependents ExpressVPN_10.4.1.2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\ProductIcon = "C:\\Windows\\Installer\\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\\app_icon.ico" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}v10.4.1.2\\" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node\CLSID\{3e705353-af85-4ad9-9750-7fb07347eb98}\LocalServer32\ = "\"C:\\Program Files (x86)\\ExpressVPN\\expressvpn-ui\\ExpressVPNNotificationService.exe\" -ToastActivated" ExpressVPNNotificationService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\Version = "10.4.1.2" ExpressVPN_10.4.1.2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\shell msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\Version = "168034305" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\Assignment = "1" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node\CLSID\{3e705353-af85-4ad9-9750-7fb07347eb98} ExpressVPNNotificationService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\URL Protocol msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E3C9B5EC98822F49A954F8B67D08833 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\Clients = 3a0000000000 msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node\CLSID ExpressVPNNotificationService.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\DefaultIcon\ = "\"C:\\Program Files (x86)\\ExpressVPN\\expressvpn-ui\\ExpressVPN.exe,1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\shell\open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\Dependents\{336616d6-abef-4ff8-9afd-43ceb249ff9a} ExpressVPN_10.4.1.2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\Version = "10.4.1.2" ExpressVPN_10.4.1.2.exe Key created \REGISTRY\MACHINE\Software\Classes\expressvpn msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\ = "URL:ExpressVPN Protocol" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}v10.4.1.2\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\Dependents\{336616d6-abef-4ff8-9afd-43ceb249ff9a} ExpressVPN_10.4.1.2.exe -
Processes:
ExpressVPN.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 ExpressVPN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e ExpressVPN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e ExpressVPN.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Cpecf.exeWerFault.exemsiexec.exeMsiExec.exeExpressVPN.exepid process 3172 Cpecf.exe 3172 Cpecf.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 416 WerFault.exe 4192 msiexec.exe 4192 msiexec.exe 4856 MsiExec.exe 4856 MsiExec.exe 4796 ExpressVPN.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Cpecf.exevssvc.exeWerFault.exewindowsupdate.exeExpressVPN_10.4.1.2.exemsiexec.exesrtasks.exedescription pid process Token: SeDebugPrivilege 3172 Cpecf.exe Token: SeBackupPrivilege 3488 vssvc.exe Token: SeRestorePrivilege 3488 vssvc.exe Token: SeAuditPrivilege 3488 vssvc.exe Token: SeDebugPrivilege 416 WerFault.exe Token: SeDebugPrivilege 2324 windowsupdate.exe Token: 33 2324 windowsupdate.exe Token: SeIncBasePriorityPrivilege 2324 windowsupdate.exe Token: SeShutdownPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeIncreaseQuotaPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeSecurityPrivilege 4192 msiexec.exe Token: SeCreateTokenPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeAssignPrimaryTokenPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeLockMemoryPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeIncreaseQuotaPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeMachineAccountPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeTcbPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeSecurityPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeTakeOwnershipPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeLoadDriverPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeSystemProfilePrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeSystemtimePrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeProfSingleProcessPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeIncBasePriorityPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeCreatePagefilePrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeCreatePermanentPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeBackupPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeRestorePrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeShutdownPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeDebugPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeAuditPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeSystemEnvironmentPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeChangeNotifyPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeRemoteShutdownPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeUndockPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeSyncAgentPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeEnableDelegationPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeManageVolumePrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeImpersonatePrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeCreateGlobalPrivilege 4084 ExpressVPN_10.4.1.2.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: 33 2324 windowsupdate.exe Token: SeIncBasePriorityPrivilege 2324 windowsupdate.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeBackupPrivilege 4116 srtasks.exe Token: SeRestorePrivilege 4116 srtasks.exe Token: SeSecurityPrivilege 4116 srtasks.exe Token: SeTakeOwnershipPrivilege 4116 srtasks.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeBackupPrivilege 4116 srtasks.exe Token: SeRestorePrivilege 4116 srtasks.exe Token: SeSecurityPrivilege 4116 srtasks.exe Token: SeTakeOwnershipPrivilege 4116 srtasks.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe Token: SeRestorePrivilege 4192 msiexec.exe Token: SeTakeOwnershipPrivilege 4192 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
ExpressVPN.exepid process 4796 ExpressVPN.exe 4796 ExpressVPN.exe 4796 ExpressVPN.exe 4796 ExpressVPN.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
ExpressVPN.exepid process 4796 ExpressVPN.exe 4796 ExpressVPN.exe 4796 ExpressVPN.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
Express Vpn Cracked.exeXlpzxnsnafub.exeActg.exeXlpzxnsnafub.exewindowsupdate.exemsiexec.exeMsiExec.exeMsiExec.exesvchost.exeExpressVPN.exedescription pid process target process PID 860 wrote to memory of 768 860 Express Vpn Cracked.exe Actg.exe PID 860 wrote to memory of 768 860 Express Vpn Cracked.exe Actg.exe PID 860 wrote to memory of 768 860 Express Vpn Cracked.exe Actg.exe PID 860 wrote to memory of 3172 860 Express Vpn Cracked.exe Cpecf.exe PID 860 wrote to memory of 3172 860 Express Vpn Cracked.exe Cpecf.exe PID 860 wrote to memory of 3940 860 Express Vpn Cracked.exe Xlpzxnsnafub.exe PID 860 wrote to memory of 3940 860 Express Vpn Cracked.exe Xlpzxnsnafub.exe PID 860 wrote to memory of 3940 860 Express Vpn Cracked.exe Xlpzxnsnafub.exe PID 3940 wrote to memory of 2756 3940 Xlpzxnsnafub.exe Xlpzxnsnafub.exe PID 3940 wrote to memory of 2756 3940 Xlpzxnsnafub.exe Xlpzxnsnafub.exe PID 3940 wrote to memory of 2756 3940 Xlpzxnsnafub.exe Xlpzxnsnafub.exe PID 768 wrote to memory of 2324 768 Actg.exe windowsupdate.exe PID 768 wrote to memory of 2324 768 Actg.exe windowsupdate.exe PID 768 wrote to memory of 2324 768 Actg.exe windowsupdate.exe PID 2756 wrote to memory of 4084 2756 Xlpzxnsnafub.exe ExpressVPN_10.4.1.2.exe PID 2756 wrote to memory of 4084 2756 Xlpzxnsnafub.exe ExpressVPN_10.4.1.2.exe PID 2756 wrote to memory of 4084 2756 Xlpzxnsnafub.exe ExpressVPN_10.4.1.2.exe PID 2324 wrote to memory of 1000 2324 windowsupdate.exe netsh.exe PID 2324 wrote to memory of 1000 2324 windowsupdate.exe netsh.exe PID 2324 wrote to memory of 1000 2324 windowsupdate.exe netsh.exe PID 4192 wrote to memory of 4448 4192 msiexec.exe MsiExec.exe PID 4192 wrote to memory of 4448 4192 msiexec.exe MsiExec.exe PID 4192 wrote to memory of 4448 4192 msiexec.exe MsiExec.exe PID 4448 wrote to memory of 4508 4448 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4508 4448 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4508 4448 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4664 4448 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4664 4448 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4664 4448 MsiExec.exe rundll32.exe PID 4192 wrote to memory of 4856 4192 msiexec.exe MsiExec.exe PID 4192 wrote to memory of 4856 4192 msiexec.exe MsiExec.exe PID 4192 wrote to memory of 4856 4192 msiexec.exe MsiExec.exe PID 4856 wrote to memory of 4936 4856 MsiExec.exe rundll32.exe PID 4856 wrote to memory of 4936 4856 MsiExec.exe rundll32.exe PID 4856 wrote to memory of 4936 4856 MsiExec.exe rundll32.exe PID 4856 wrote to memory of 5112 4856 MsiExec.exe rundll32.exe PID 4856 wrote to memory of 5112 4856 MsiExec.exe rundll32.exe PID 4856 wrote to memory of 5112 4856 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4380 4448 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4380 4448 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4380 4448 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4572 4448 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4572 4448 MsiExec.exe rundll32.exe PID 4448 wrote to memory of 4572 4448 MsiExec.exe rundll32.exe PID 4752 wrote to memory of 4796 4752 svchost.exe ExpressVPN.exe PID 4752 wrote to memory of 4796 4752 svchost.exe ExpressVPN.exe PID 4752 wrote to memory of 4796 4752 svchost.exe ExpressVPN.exe PID 4752 wrote to memory of 4816 4752 svchost.exe ExpressVPNNotificationService.exe PID 4752 wrote to memory of 4816 4752 svchost.exe ExpressVPNNotificationService.exe PID 4752 wrote to memory of 4816 4752 svchost.exe ExpressVPNNotificationService.exe PID 4796 wrote to memory of 4688 4796 ExpressVPN.exe ExpressVPNNotificationService.exe PID 4796 wrote to memory of 4688 4796 ExpressVPN.exe ExpressVPNNotificationService.exe PID 4796 wrote to memory of 4688 4796 ExpressVPN.exe ExpressVPNNotificationService.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Express Vpn Cracked.exe"C:\Users\Admin\AppData\Local\Temp\Express Vpn Cracked.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Actg.exe"C:\Users\Admin\AppData\Local\Temp\Actg.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\windowsupdate.exe"C:\Users\Admin\windowsupdate.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\windowsupdate.exe" "windowsupdate.exe" ENABLE4⤵
-
C:\Users\Admin\AppData\Local\Temp\Cpecf.exe"C:\Users\Admin\AppData\Local\Temp\Cpecf.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3172 -s 10803⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Xlpzxnsnafub.exe"C:\Users\Admin\AppData\Local\Temp\Xlpzxnsnafub.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{655AF3CA-6185-4F85-B650-DB153A7A1ED4}\.cr\Xlpzxnsnafub.exe"C:\Windows\Temp\{655AF3CA-6185-4F85-B650-DB153A7A1ED4}\.cr\Xlpzxnsnafub.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Xlpzxnsnafub.exe" -burn.filehandle.attached=524 -burn.filehandle.self=5323⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.be\ExpressVPN_10.4.1.2.exe"C:\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.be\ExpressVPN_10.4.1.2.exe" -q -burn.elevated BurnPipe.{92007EC6-90CD-4187-9CCF-F8EE6A39FE74} {58A6CB07-1805-4F94-8D4A-A3CF58B5ABCC} 27564⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN.exe"C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN.exe" install4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPNNotificationService.exe"C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPNNotificationService.exe" uihaslaunched5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPNNotificationService.exe"C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPNNotificationService.exe"4⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A7A1BF9756D622047BCFD61F1890DEE02⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI38B4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259341531 2 WixSharp Setup!ExpressVpn.Client.Setup.Actions.SetWin103⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI4344.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259343234 6 WixSharp Setup!ExpressVpn.Client.Setup.Actions.SetWindowsBuild3⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI61D0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259351062 28 WixSharp Setup!ExpressVpn.Client.Setup.Actions.RemoveUserFolderData3⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI6637.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259352203 38 WixSharp Setup!ExpressVpn.Client.Setup.Actions.DeleteBinaries3⤵
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 472C6A97ECB7085AA25EA6BBCDC562B9 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI55B8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259348031 18 WixSharp Setup!ExpressVpn.Client.Setup.Actions.GenerateToken3⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI5A6C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259349156 24 WixSharp Setup!ExpressVpn.Client.Setup.Actions.SetBrowserHelperPath3⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.logMD5
47c6667a0d9d4bdb4e5215578054c0d6
SHA156f494a719ad3cf29723458166d9831719941fa4
SHA256b2526c381832cbe24e8f0d14bb7dbf8e9ab753e087a2f9b7d6b8e36065672355
SHA5127af086ffeee540b70efd190db4b77867356452d2b22904665d6fb53fa0b3749cba6f0613cb96134bed91ba2fa80bf4cced1d8af28679d27f230748fc0d38e5e5
-
C:\Users\Admin\AppData\Local\Temp\Actg.exeMD5
173f905dbe88ebe490e78956b75b1f44
SHA17a138d6771fc30124810984c1ba9f5c59533331f
SHA256094b72206ae5013037de2de5fc6ee72b978a6c94f6aaa2097294c961969bc761
SHA5122e22eda3d1bbf07b475f7c295ab5ab7379bb8191336dfdf2ea147b26d88cec34b47eaffacbbc3561bb7f60a35f72433a7c62f37b98f4c3e5a76134b7ab7ee2af
-
C:\Users\Admin\AppData\Local\Temp\Actg.exeMD5
173f905dbe88ebe490e78956b75b1f44
SHA17a138d6771fc30124810984c1ba9f5c59533331f
SHA256094b72206ae5013037de2de5fc6ee72b978a6c94f6aaa2097294c961969bc761
SHA5122e22eda3d1bbf07b475f7c295ab5ab7379bb8191336dfdf2ea147b26d88cec34b47eaffacbbc3561bb7f60a35f72433a7c62f37b98f4c3e5a76134b7ab7ee2af
-
C:\Users\Admin\AppData\Local\Temp\Cpecf.exeMD5
fdad75d3ffdc8e86442e86c59b0e4746
SHA1f37fc124761d78d834b3f0b01724f3aaf15654f4
SHA256f9fa4e1d6a6ce8b85547c0194433a5636106adff2f75cb6d3b8ee0b6c63c5bbf
SHA51275261118938e438338b0de8dde5d6477740d21c5211be6f89611d0c9644a7f923db69aa6adc352c263fcd1cf71bda2bbba6e8b7f8ad95cb6e8a033cb75a03cb7
-
C:\Users\Admin\AppData\Local\Temp\Cpecf.exeMD5
fdad75d3ffdc8e86442e86c59b0e4746
SHA1f37fc124761d78d834b3f0b01724f3aaf15654f4
SHA256f9fa4e1d6a6ce8b85547c0194433a5636106adff2f75cb6d3b8ee0b6c63c5bbf
SHA51275261118938e438338b0de8dde5d6477740d21c5211be6f89611d0c9644a7f923db69aa6adc352c263fcd1cf71bda2bbba6e8b7f8ad95cb6e8a033cb75a03cb7
-
C:\Users\Admin\AppData\Local\Temp\ExpressVPN_20210807192254_000_MainMsi.logMD5
c1b7bfb52c17ef8966cf54f5a3b217b1
SHA1154a0d039a4475c16d4109a5f2f1b4ad2db12a6e
SHA256da09816b5e855050335de9bedcfc02f6d11c4d92d3929b603d8e44cb3814a8c8
SHA5125fe88cd0c7d3c0fa2688aa46069cfa6cad0d546f12f0bc7baa312ffbecbaf2cf4694f444449e578c2965db2261156dd5bb64dbd1ab20ef9f8bd036a7939b9343
-
C:\Users\Admin\AppData\Local\Temp\Xlpzxnsnafub.exeMD5
e0659494c5b27f2bef8c91eed5b8d34e
SHA15b9fe6c75be4b1982154dfda3b621d562c9e0ee6
SHA256f52702b198a2ea5f46613b69bd1eb5069f79c7ccb02194187d27f1f5f561d2c4
SHA51265e650946a69f2271b1deff4882c0a7c4d61e57a5feaae6cd3c866353ab6b24dde78831dfe980dae7443338b4c83d78120e9d3b342b1e391b3522db9af7dc05f
-
C:\Users\Admin\AppData\Local\Temp\Xlpzxnsnafub.exeMD5
e0659494c5b27f2bef8c91eed5b8d34e
SHA15b9fe6c75be4b1982154dfda3b621d562c9e0ee6
SHA256f52702b198a2ea5f46613b69bd1eb5069f79c7ccb02194187d27f1f5f561d2c4
SHA51265e650946a69f2271b1deff4882c0a7c4d61e57a5feaae6cd3c866353ab6b24dde78831dfe980dae7443338b4c83d78120e9d3b342b1e391b3522db9af7dc05f
-
C:\Users\Admin\windowsupdate.exeMD5
173f905dbe88ebe490e78956b75b1f44
SHA17a138d6771fc30124810984c1ba9f5c59533331f
SHA256094b72206ae5013037de2de5fc6ee72b978a6c94f6aaa2097294c961969bc761
SHA5122e22eda3d1bbf07b475f7c295ab5ab7379bb8191336dfdf2ea147b26d88cec34b47eaffacbbc3561bb7f60a35f72433a7c62f37b98f4c3e5a76134b7ab7ee2af
-
C:\Users\Admin\windowsupdate.exeMD5
173f905dbe88ebe490e78956b75b1f44
SHA17a138d6771fc30124810984c1ba9f5c59533331f
SHA256094b72206ae5013037de2de5fc6ee72b978a6c94f6aaa2097294c961969bc761
SHA5122e22eda3d1bbf07b475f7c295ab5ab7379bb8191336dfdf2ea147b26d88cec34b47eaffacbbc3561bb7f60a35f72433a7c62f37b98f4c3e5a76134b7ab7ee2af
-
C:\Windows\Installer\MSI38B4.tmpMD5
39c3069addf8da0932e5eeaab2aa73da
SHA1df90ef15de2d91211fd6f58deeddf144de8f37cc
SHA2566b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4
SHA512e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920
-
C:\Windows\Installer\MSI4344.tmpMD5
39c3069addf8da0932e5eeaab2aa73da
SHA1df90ef15de2d91211fd6f58deeddf144de8f37cc
SHA2566b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4
SHA512e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920
-
C:\Windows\Installer\MSI4A3C.tmpMD5
a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\Installer\MSI4FDB.tmpMD5
a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
C:\Windows\Installer\MSI55B8.tmpMD5
39c3069addf8da0932e5eeaab2aa73da
SHA1df90ef15de2d91211fd6f58deeddf144de8f37cc
SHA2566b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4
SHA512e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920
-
C:\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.be\ExpressVPN_10.4.1.2.exeMD5
013dbe59ad341d18dd156ffde8c5afd8
SHA1c5afbf4233e8ddc7a42b4c53a2bff2799fc2a369
SHA256d552cda9a12a49320cd11afcc185309ff14461cfdc6231b6792cd770f69a817a
SHA512cd87767db1597a17aa38ba9d93f69cc9134de613c8434ac59a765940d23a377f4a17afed93f9e10ffcd835ad77fd5a0a6e94794b0ccf585afce0fe41951c60ff
-
C:\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.be\ExpressVPN_10.4.1.2.exeMD5
013dbe59ad341d18dd156ffde8c5afd8
SHA1c5afbf4233e8ddc7a42b4c53a2bff2799fc2a369
SHA256d552cda9a12a49320cd11afcc185309ff14461cfdc6231b6792cd770f69a817a
SHA512cd87767db1597a17aa38ba9d93f69cc9134de613c8434ac59a765940d23a377f4a17afed93f9e10ffcd835ad77fd5a0a6e94794b0ccf585afce0fe41951c60ff
-
C:\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\MainMsiMD5
ad0376bc99575c74b24a3a853d2b2108
SHA1a39f23d5a797c02a1ad9ee52f64bbc3eb0b2c420
SHA256b4d829687464f819f1635d1de79959b99eb73ee4a5acb0705272c94f17fe1516
SHA51204b71ae871d37835c3ac96e91775fa029119e2733c58115758c72b331574b6559c67324239a2d0731fb46ab2e7b46a3a6685f905b616d2a782423e45a91139cc
-
C:\Windows\Temp\{655AF3CA-6185-4F85-B650-DB153A7A1ED4}\.cr\Xlpzxnsnafub.exeMD5
013dbe59ad341d18dd156ffde8c5afd8
SHA1c5afbf4233e8ddc7a42b4c53a2bff2799fc2a369
SHA256d552cda9a12a49320cd11afcc185309ff14461cfdc6231b6792cd770f69a817a
SHA512cd87767db1597a17aa38ba9d93f69cc9134de613c8434ac59a765940d23a377f4a17afed93f9e10ffcd835ad77fd5a0a6e94794b0ccf585afce0fe41951c60ff
-
C:\Windows\Temp\{655AF3CA-6185-4F85-B650-DB153A7A1ED4}\.cr\Xlpzxnsnafub.exeMD5
013dbe59ad341d18dd156ffde8c5afd8
SHA1c5afbf4233e8ddc7a42b4c53a2bff2799fc2a369
SHA256d552cda9a12a49320cd11afcc185309ff14461cfdc6231b6792cd770f69a817a
SHA512cd87767db1597a17aa38ba9d93f69cc9134de613c8434ac59a765940d23a377f4a17afed93f9e10ffcd835ad77fd5a0a6e94794b0ccf585afce0fe41951c60ff
-
\Windows\Installer\MSI38B4.tmpMD5
39c3069addf8da0932e5eeaab2aa73da
SHA1df90ef15de2d91211fd6f58deeddf144de8f37cc
SHA2566b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4
SHA512e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920
-
\Windows\Installer\MSI38B4.tmpMD5
39c3069addf8da0932e5eeaab2aa73da
SHA1df90ef15de2d91211fd6f58deeddf144de8f37cc
SHA2566b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4
SHA512e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920
-
\Windows\Installer\MSI38B4.tmp-\Common.Logging.Core.dllMD5
314445e176cd8ccfe3cf274c263e2cdc
SHA1df6730124e7b1a288f97cb7fdbabf53481379235
SHA2563d806326bfce9ddacdd922bdf9c96e45de9172f45a8a0af4cc515381cea01984
SHA512da14d68cfe5218fc98e12cbb18bb8ba56843e7b9a4f20c302d3980171d4107a2492eb9ff27799924541de8629bc037572bb29c6f87fd908b1f5bc6d68d26e1bc
-
\Windows\Installer\MSI38B4.tmp-\Common.Logging.Core.dllMD5
314445e176cd8ccfe3cf274c263e2cdc
SHA1df6730124e7b1a288f97cb7fdbabf53481379235
SHA2563d806326bfce9ddacdd922bdf9c96e45de9172f45a8a0af4cc515381cea01984
SHA512da14d68cfe5218fc98e12cbb18bb8ba56843e7b9a4f20c302d3980171d4107a2492eb9ff27799924541de8629bc037572bb29c6f87fd908b1f5bc6d68d26e1bc
-
\Windows\Installer\MSI38B4.tmp-\Common.Logging.dllMD5
9d7f9e7a508452626cc8a4a735a65819
SHA197d55bcae5ed46270e092515276bedddaa7a0533
SHA2562155289b62e2a05c322f7eb23ffb9f87fe48923bec12722a117d00857370bb0e
SHA512f41f15488fb791fa7af978a439b2eadefaf66ca0cf8f1a915f186b45dd401db02a6fb65c177c390e7b570e24c03d26061abc4511d154dc9b2ddef0305f503595
-
\Windows\Installer\MSI38B4.tmp-\Common.Logging.dllMD5
9d7f9e7a508452626cc8a4a735a65819
SHA197d55bcae5ed46270e092515276bedddaa7a0533
SHA2562155289b62e2a05c322f7eb23ffb9f87fe48923bec12722a117d00857370bb0e
SHA512f41f15488fb791fa7af978a439b2eadefaf66ca0cf8f1a915f186b45dd401db02a6fb65c177c390e7b570e24c03d26061abc4511d154dc9b2ddef0305f503595
-
\Windows\Installer\MSI38B4.tmp-\ExpressVPN.Utils.dllMD5
00059169c1323addd07e77f36b2d6ac4
SHA1822bf8d5ebad1f4604e98dcf2a2ee4945c36bcbe
SHA2562cedb1f3f8584b739138dcc95364d34b88d19ba121a1582e4ddc36f3fd35c1c9
SHA512afc37ad026e2e375348c4385f5c5aaf6eb7030e05d9bb7370bca38d459b0a7626888bb6826d6d4f9ab6e804c03bdf3472503c980451205b568bebe30002027a5
-
\Windows\Installer\MSI38B4.tmp-\ExpressVPN.Utils.dllMD5
00059169c1323addd07e77f36b2d6ac4
SHA1822bf8d5ebad1f4604e98dcf2a2ee4945c36bcbe
SHA2562cedb1f3f8584b739138dcc95364d34b88d19ba121a1582e4ddc36f3fd35c1c9
SHA512afc37ad026e2e375348c4385f5c5aaf6eb7030e05d9bb7370bca38d459b0a7626888bb6826d6d4f9ab6e804c03bdf3472503c980451205b568bebe30002027a5
-
\Windows\Installer\MSI38B4.tmp-\Microsoft.Deployment.WindowsInstaller.dllMD5
1a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
\Windows\Installer\MSI38B4.tmp-\Microsoft.Deployment.WindowsInstaller.dllMD5
1a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
\Windows\Installer\MSI38B4.tmp-\WixSharp Setup.exeMD5
8ba372785d5ab303bf4ac6884a1ee2a1
SHA19a92d202dc604adbc553016e7a9c3750e3646328
SHA25641ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83
SHA5121c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d
-
\Windows\Installer\MSI38B4.tmp-\WixSharp Setup.exeMD5
8ba372785d5ab303bf4ac6884a1ee2a1
SHA19a92d202dc604adbc553016e7a9c3750e3646328
SHA25641ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83
SHA5121c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d
-
\Windows\Installer\MSI4344.tmpMD5
39c3069addf8da0932e5eeaab2aa73da
SHA1df90ef15de2d91211fd6f58deeddf144de8f37cc
SHA2566b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4
SHA512e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920
-
\Windows\Installer\MSI4344.tmpMD5
39c3069addf8da0932e5eeaab2aa73da
SHA1df90ef15de2d91211fd6f58deeddf144de8f37cc
SHA2566b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4
SHA512e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920
-
\Windows\Installer\MSI4344.tmp-\Common.Logging.Core.dllMD5
314445e176cd8ccfe3cf274c263e2cdc
SHA1df6730124e7b1a288f97cb7fdbabf53481379235
SHA2563d806326bfce9ddacdd922bdf9c96e45de9172f45a8a0af4cc515381cea01984
SHA512da14d68cfe5218fc98e12cbb18bb8ba56843e7b9a4f20c302d3980171d4107a2492eb9ff27799924541de8629bc037572bb29c6f87fd908b1f5bc6d68d26e1bc
-
\Windows\Installer\MSI4344.tmp-\Common.Logging.Core.dllMD5
314445e176cd8ccfe3cf274c263e2cdc
SHA1df6730124e7b1a288f97cb7fdbabf53481379235
SHA2563d806326bfce9ddacdd922bdf9c96e45de9172f45a8a0af4cc515381cea01984
SHA512da14d68cfe5218fc98e12cbb18bb8ba56843e7b9a4f20c302d3980171d4107a2492eb9ff27799924541de8629bc037572bb29c6f87fd908b1f5bc6d68d26e1bc
-
\Windows\Installer\MSI4344.tmp-\Common.Logging.dllMD5
9d7f9e7a508452626cc8a4a735a65819
SHA197d55bcae5ed46270e092515276bedddaa7a0533
SHA2562155289b62e2a05c322f7eb23ffb9f87fe48923bec12722a117d00857370bb0e
SHA512f41f15488fb791fa7af978a439b2eadefaf66ca0cf8f1a915f186b45dd401db02a6fb65c177c390e7b570e24c03d26061abc4511d154dc9b2ddef0305f503595
-
\Windows\Installer\MSI4344.tmp-\Common.Logging.dllMD5
9d7f9e7a508452626cc8a4a735a65819
SHA197d55bcae5ed46270e092515276bedddaa7a0533
SHA2562155289b62e2a05c322f7eb23ffb9f87fe48923bec12722a117d00857370bb0e
SHA512f41f15488fb791fa7af978a439b2eadefaf66ca0cf8f1a915f186b45dd401db02a6fb65c177c390e7b570e24c03d26061abc4511d154dc9b2ddef0305f503595
-
\Windows\Installer\MSI4344.tmp-\ExpressVPN.Utils.dllMD5
00059169c1323addd07e77f36b2d6ac4
SHA1822bf8d5ebad1f4604e98dcf2a2ee4945c36bcbe
SHA2562cedb1f3f8584b739138dcc95364d34b88d19ba121a1582e4ddc36f3fd35c1c9
SHA512afc37ad026e2e375348c4385f5c5aaf6eb7030e05d9bb7370bca38d459b0a7626888bb6826d6d4f9ab6e804c03bdf3472503c980451205b568bebe30002027a5
-
\Windows\Installer\MSI4344.tmp-\ExpressVPN.Utils.dllMD5
00059169c1323addd07e77f36b2d6ac4
SHA1822bf8d5ebad1f4604e98dcf2a2ee4945c36bcbe
SHA2562cedb1f3f8584b739138dcc95364d34b88d19ba121a1582e4ddc36f3fd35c1c9
SHA512afc37ad026e2e375348c4385f5c5aaf6eb7030e05d9bb7370bca38d459b0a7626888bb6826d6d4f9ab6e804c03bdf3472503c980451205b568bebe30002027a5
-
\Windows\Installer\MSI4344.tmp-\Microsoft.Deployment.WindowsInstaller.dllMD5
1a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
\Windows\Installer\MSI4344.tmp-\Microsoft.Deployment.WindowsInstaller.dllMD5
1a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
\Windows\Installer\MSI4344.tmp-\WixSharp Setup.exeMD5
8ba372785d5ab303bf4ac6884a1ee2a1
SHA19a92d202dc604adbc553016e7a9c3750e3646328
SHA25641ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83
SHA5121c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d
-
\Windows\Installer\MSI4344.tmp-\WixSharp Setup.exeMD5
8ba372785d5ab303bf4ac6884a1ee2a1
SHA19a92d202dc604adbc553016e7a9c3750e3646328
SHA25641ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83
SHA5121c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d
-
\Windows\Installer\MSI4A3C.tmpMD5
a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
\Windows\Installer\MSI4FDB.tmpMD5
a3ae5d86ecf38db9427359ea37a5f646
SHA1eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA51296ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
-
\Windows\Installer\MSI55B8.tmpMD5
39c3069addf8da0932e5eeaab2aa73da
SHA1df90ef15de2d91211fd6f58deeddf144de8f37cc
SHA2566b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4
SHA512e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920
-
\Windows\Installer\MSI55B8.tmpMD5
39c3069addf8da0932e5eeaab2aa73da
SHA1df90ef15de2d91211fd6f58deeddf144de8f37cc
SHA2566b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4
SHA512e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920
-
\Windows\Installer\MSI55B8.tmp-\ExpressVpn.Client.Setup.CustomActions.dllMD5
cc4d98300b486281895153521a98c35b
SHA1a109edbd7872b192b2bc853530640484fe5103b9
SHA256bf0269d1de71a01e7d5e83c6145242e00193883873fa5b57505954cfe92f00c1
SHA512f1196c0bc1dc5cdb945db0618e685a2a89d9da58f5e1c78d3152c45a9e4985b1eeeda1bd5694a4a3126880977bed67aaeecebf4699fc376704a68cb36f4d83a1
-
\Windows\Installer\MSI55B8.tmp-\ExpressVpn.Client.Setup.CustomActions.dllMD5
cc4d98300b486281895153521a98c35b
SHA1a109edbd7872b192b2bc853530640484fe5103b9
SHA256bf0269d1de71a01e7d5e83c6145242e00193883873fa5b57505954cfe92f00c1
SHA512f1196c0bc1dc5cdb945db0618e685a2a89d9da58f5e1c78d3152c45a9e4985b1eeeda1bd5694a4a3126880977bed67aaeecebf4699fc376704a68cb36f4d83a1
-
\Windows\Installer\MSI55B8.tmp-\Microsoft.Deployment.WindowsInstaller.dllMD5
1a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
\Windows\Installer\MSI55B8.tmp-\Microsoft.Deployment.WindowsInstaller.dllMD5
1a5caea6734fdd07caa514c3f3fb75da
SHA1f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1
-
\Windows\Installer\MSI55B8.tmp-\WixSharp Setup.exeMD5
8ba372785d5ab303bf4ac6884a1ee2a1
SHA19a92d202dc604adbc553016e7a9c3750e3646328
SHA25641ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83
SHA5121c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d
-
\Windows\Installer\MSI55B8.tmp-\WixSharp Setup.exeMD5
8ba372785d5ab303bf4ac6884a1ee2a1
SHA19a92d202dc604adbc553016e7a9c3750e3646328
SHA25641ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83
SHA5121c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d
-
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\BootstrapperCore.dllMD5
b0d10a2a622a322788780e7a3cbb85f3
SHA104d90b16fa7b47a545c1133d5c0ca9e490f54633
SHA256f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
SHA51262b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f
-
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\BootstrapperCore.dllMD5
b0d10a2a622a322788780e7a3cbb85f3
SHA104d90b16fa7b47a545c1133d5c0ca9e490f54633
SHA256f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
SHA51262b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f
-
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\Castle.Core.dllMD5
d081621aef9edbb8f2d31f8b3ab9350b
SHA1806b52922f775b7d69087cc0a8bd3a4f692d48aa
SHA25680f311adaed94d41436f9a00cbb3f7b010107c7ba4e445fde8a5e9ecc42bb8ba
SHA5129068bc9762aba9cab6e84c775de8ce9976221d8483dbff3b5c22669a873127241e8d15ece897e31c4a7da8a2bc60f58ef24aae93710dde4e79f72fd088762120
-
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\Castle.Core.dllMD5
d081621aef9edbb8f2d31f8b3ab9350b
SHA1806b52922f775b7d69087cc0a8bd3a4f692d48aa
SHA25680f311adaed94d41436f9a00cbb3f7b010107c7ba4e445fde8a5e9ecc42bb8ba
SHA5129068bc9762aba9cab6e84c775de8ce9976221d8483dbff3b5c22669a873127241e8d15ece897e31c4a7da8a2bc60f58ef24aae93710dde4e79f72fd088762120
-
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\Castle.Windsor.dllMD5
60e8943d1e726dd45a9efc1530bee9c2
SHA1823e37faaa969768525163d84657780fa598fbd6
SHA256289976e538e8cb98d4e41640f120dd1044cd6479e97bb1768c96e6201ece09c5
SHA5121a0a30c2a49b49cd1067e1364d1e327bc2c5a2046e06898336596849f27462af027cb49814a89b3a8b90f90404b86b83a58a5612c32c1162ac93d7c80ffe01c7
-
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\Castle.Windsor.dllMD5
60e8943d1e726dd45a9efc1530bee9c2
SHA1823e37faaa969768525163d84657780fa598fbd6
SHA256289976e538e8cb98d4e41640f120dd1044cd6479e97bb1768c96e6201ece09c5
SHA5121a0a30c2a49b49cd1067e1364d1e327bc2c5a2046e06898336596849f27462af027cb49814a89b3a8b90f90404b86b83a58a5612c32c1162ac93d7c80ffe01c7
-
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\WixSharp Setup.exeMD5
7dc9a7ab0616a027ce1dad2e18c6ec1c
SHA10d581fd72c3625949fad02d59e7ae9d07ae2eb7c
SHA2562144b22436751ca1160d760d81e31689c372e6a83f54a6a503abb6101468de81
SHA512561c37cba8243da41831f714ce10bca35d7d0451406c1c53515469c9be17c21b671778407deb802724b87b09092d628c2ef7e6117925995fb4a55fd17ce85e97
-
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\WixSharp Setup.exeMD5
7dc9a7ab0616a027ce1dad2e18c6ec1c
SHA10d581fd72c3625949fad02d59e7ae9d07ae2eb7c
SHA2562144b22436751ca1160d760d81e31689c372e6a83f54a6a503abb6101468de81
SHA512561c37cba8243da41831f714ce10bca35d7d0451406c1c53515469c9be17c21b671778407deb802724b87b09092d628c2ef7e6117925995fb4a55fd17ce85e97
-
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\mbahost.dllMD5
c59832217903ce88793a6c40888e3cae
SHA16d9facabf41dcf53281897764d467696780623b8
SHA2569dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
SHA5121b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9
-
memory/768-129-0x0000000000AA0000-0x0000000000AA1000-memory.dmpFilesize
4KB
-
memory/768-117-0x0000000000000000-mapping.dmp
-
memory/860-114-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/860-116-0x0000000004630000-0x0000000004632000-memory.dmpFilesize
8KB
-
memory/1000-164-0x0000000000000000-mapping.dmp
-
memory/2324-156-0x0000000000000000-mapping.dmp
-
memory/2324-159-0x0000000001680000-0x0000000001681000-memory.dmpFilesize
4KB
-
memory/2756-154-0x0000000007870000-0x0000000007871000-memory.dmpFilesize
4KB
-
memory/2756-148-0x0000000006FE0000-0x0000000006FE1000-memory.dmpFilesize
4KB
-
memory/2756-155-0x000000000A210000-0x000000000A211000-memory.dmpFilesize
4KB
-
memory/2756-153-0x00000000037A7000-0x00000000037A9000-memory.dmpFilesize
8KB
-
memory/2756-152-0x00000000037A4000-0x00000000037A5000-memory.dmpFilesize
4KB
-
memory/2756-151-0x00000000072D0000-0x00000000072D1000-memory.dmpFilesize
4KB
-
memory/2756-130-0x0000000000000000-mapping.dmp
-
memory/2756-145-0x00000000037A3000-0x00000000037A4000-memory.dmpFilesize
4KB
-
memory/2756-136-0x00000000037A1000-0x00000000037A2000-memory.dmpFilesize
4KB
-
memory/2756-135-0x00000000037A0000-0x00000000037A1000-memory.dmpFilesize
4KB
-
memory/2756-139-0x00000000038E0000-0x00000000038E1000-memory.dmpFilesize
4KB
-
memory/2756-143-0x0000000007050000-0x0000000007051000-memory.dmpFilesize
4KB
-
memory/3172-134-0x00000222E4D70000-0x00000222E4D71000-memory.dmpFilesize
4KB
-
memory/3172-163-0x0000022280260000-0x0000022280261000-memory.dmpFilesize
4KB
-
memory/3172-127-0x00000222FEED0000-0x00000222FEED2000-memory.dmpFilesize
8KB
-
memory/3172-122-0x00000222E49E0000-0x00000222E49E1000-memory.dmpFilesize
4KB
-
memory/3172-119-0x0000000000000000-mapping.dmp
-
memory/3940-125-0x0000000000000000-mapping.dmp
-
memory/4084-160-0x0000000000000000-mapping.dmp
-
memory/4380-312-0x0000000004281000-0x0000000004282000-memory.dmpFilesize
4KB
-
memory/4380-299-0x0000000000000000-mapping.dmp
-
memory/4380-316-0x0000000004286000-0x0000000004287000-memory.dmpFilesize
4KB
-
memory/4380-311-0x0000000004280000-0x0000000004281000-memory.dmpFilesize
4KB
-
memory/4380-315-0x0000000004284000-0x0000000004286000-memory.dmpFilesize
8KB
-
memory/4380-313-0x0000000004283000-0x0000000004284000-memory.dmpFilesize
4KB
-
memory/4380-309-0x0000000006880000-0x0000000006881000-memory.dmpFilesize
4KB
-
memory/4448-169-0x0000000000000000-mapping.dmp
-
memory/4508-188-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/4508-192-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/4508-181-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/4508-182-0x0000000005074000-0x0000000005076000-memory.dmpFilesize
8KB
-
memory/4508-174-0x0000000000000000-mapping.dmp
-
memory/4508-183-0x0000000005071000-0x0000000005072000-memory.dmpFilesize
4KB
-
memory/4508-184-0x0000000005073000-0x0000000005074000-memory.dmpFilesize
4KB
-
memory/4508-195-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/4508-185-0x0000000005076000-0x0000000005077000-memory.dmpFilesize
4KB
-
memory/4508-180-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/4508-198-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/4572-314-0x0000000000000000-mapping.dmp
-
memory/4572-329-0x0000000004DC1000-0x0000000004DC2000-memory.dmpFilesize
4KB
-
memory/4572-330-0x0000000004DC3000-0x0000000004DC4000-memory.dmpFilesize
4KB
-
memory/4572-328-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/4572-332-0x0000000004DC6000-0x0000000004DC7000-memory.dmpFilesize
4KB
-
memory/4572-331-0x0000000004DC4000-0x0000000004DC6000-memory.dmpFilesize
8KB
-
memory/4664-225-0x00000000044B6000-0x00000000044B7000-memory.dmpFilesize
4KB
-
memory/4664-224-0x00000000044B4000-0x00000000044B6000-memory.dmpFilesize
8KB
-
memory/4664-203-0x0000000000000000-mapping.dmp
-
memory/4664-219-0x00000000044B1000-0x00000000044B2000-memory.dmpFilesize
4KB
-
memory/4664-218-0x00000000044B0000-0x00000000044B1000-memory.dmpFilesize
4KB
-
memory/4664-223-0x00000000044B3000-0x00000000044B4000-memory.dmpFilesize
4KB
-
memory/4688-452-0x0000000000000000-mapping.dmp
-
memory/4688-471-0x0000000005970000-0x0000000005FD2000-memory.dmpFilesize
6.4MB
-
memory/4796-351-0x00000000056D0000-0x0000000005D32000-memory.dmpFilesize
6.4MB
-
memory/4796-385-0x00000000056D0000-0x0000000005D32000-memory.dmpFilesize
6.4MB
-
memory/4796-333-0x0000000000000000-mapping.dmp
-
memory/4796-472-0x00000000056D0000-0x0000000005D32000-memory.dmpFilesize
6.4MB
-
memory/4816-431-0x0000000005320000-0x0000000005982000-memory.dmpFilesize
6.4MB
-
memory/4816-353-0x0000000005320000-0x0000000005982000-memory.dmpFilesize
6.4MB
-
memory/4816-337-0x0000000000000000-mapping.dmp
-
memory/4856-233-0x0000000000000000-mapping.dmp
-
memory/4936-261-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/4936-273-0x0000000004E36000-0x0000000004E37000-memory.dmpFilesize
4KB
-
memory/4936-240-0x0000000000000000-mapping.dmp
-
memory/4936-253-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/4936-259-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/4936-263-0x0000000007280000-0x0000000007281000-memory.dmpFilesize
4KB
-
memory/4936-268-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/4936-270-0x0000000004E31000-0x0000000004E32000-memory.dmpFilesize
4KB
-
memory/4936-272-0x0000000004E34000-0x0000000004E36000-memory.dmpFilesize
8KB
-
memory/4936-271-0x0000000004E33000-0x0000000004E34000-memory.dmpFilesize
4KB
-
memory/5112-289-0x0000000004A21000-0x0000000004A22000-memory.dmpFilesize
4KB
-
memory/5112-274-0x0000000000000000-mapping.dmp
-
memory/5112-284-0x0000000007050000-0x0000000007051000-memory.dmpFilesize
4KB
-
memory/5112-285-0x0000000007100000-0x0000000007101000-memory.dmpFilesize
4KB
-
memory/5112-286-0x0000000007000000-0x0000000007001000-memory.dmpFilesize
4KB
-
memory/5112-287-0x00000000071A0000-0x00000000071A1000-memory.dmpFilesize
4KB
-
memory/5112-295-0x00000000072A0000-0x00000000072A1000-memory.dmpFilesize
4KB
-
memory/5112-288-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/5112-291-0x0000000004A24000-0x0000000004A26000-memory.dmpFilesize
8KB
-
memory/5112-290-0x0000000004A23000-0x0000000004A24000-memory.dmpFilesize
4KB
-
memory/5112-292-0x0000000004A26000-0x0000000004A27000-memory.dmpFilesize
4KB