njrat | 5ee49e2433a68b616317e190b5a53840e58455dfccda71e4b9f6e727a3b7a7fd

Analysis

max time kernel
150s
max time network
153s
platform
windows10_x64
resource
win10v20210408
submitted
07-08-2021 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Express Vpn Cracked.exe
Size

36.3MB
MD5

4544b2f40af00c61376c030f0e102d98
SHA1

05824e0ec140e56fb066f7fffbcd79b6dadfdbf1
SHA256

5ee49e2433a68b616317e190b5a53840e58455dfccda71e4b9f6e727a3b7a7fd
SHA512

785ee454b9ae81714241ee7df9fa38e6e5e5f7a377e4ebff6d33fdf86b51b3805f13ecb0a2cdf5e24be06ebe17d3d7dd349be83bb005284d56305475654220a0

Score

10^/10

njrat poullight happy discovery evasion persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

happy

alcachofa724-46937.portmap.host:46937

Mutex

b2cfa0ba1b27be996957c11e1bf6a214

Attributes

reg_key
b2cfa0ba1b27be996957c11e1bf6a214
splitter
|'|'|

Signatures

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Cpecf.exe	family_poullight
C:\Users\Admin\AppData\Local\Temp\Cpecf.exe	family_poullight

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 416 created 3172 416 WerFault.exe Cpecf.exe
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

svchost.exe

description pid process target process

PID 4752 created 2756 4752 svchost.exe Xlpzxnsnafub.exe
PID 4752 created 2756 4752 svchost.exe Xlpzxnsnafub.exe
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers
suricata
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer
suricata
Blocklisted process makes network request 5 IoCs

Processes:

msiexec.exe

flow pid process

29 4192 msiexec.exe
31 4192 msiexec.exe
33 4192 msiexec.exe
35 4192 msiexec.exe
37 4192 msiexec.exe

description	pid	process	target process
PID 416 created 3172	416	WerFault.exe	Cpecf.exe

description	pid	process	target process
PID 4752 created 2756	4752	svchost.exe	Xlpzxnsnafub.exe
PID 4752 created 2756	4752	svchost.exe	Xlpzxnsnafub.exe

flow	pid	process
29	4192	msiexec.exe
31	4192	msiexec.exe
33	4192	msiexec.exe
35	4192	msiexec.exe
37	4192	msiexec.exe

Executes dropped EXE 9 IoCs

Processes:

Actg.exeCpecf.exeXlpzxnsnafub.exeXlpzxnsnafub.exewindowsupdate.exeExpressVPN_10.4.1.2.exeExpressVPN.exeExpressVPNNotificationService.exeExpressVPNNotificationService.exe

pid	process
768	Actg.exe
3172	Cpecf.exe
3940	Xlpzxnsnafub.exe
2756	Xlpzxnsnafub.exe
2324	windowsupdate.exe
4084	ExpressVPN_10.4.1.2.exe
4796	ExpressVPN.exe
4816	ExpressVPNNotificationService.exe
4688	ExpressVPNNotificationService.exe

Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ExpressVPN.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	ExpressVPN.exe

Drops startup file 2 IoCs

Processes:

windowsupdate.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2cfa0ba1b27be996957c11e1bf6a214.exe	windowsupdate.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b2cfa0ba1b27be996957c11e1bf6a214.exe	windowsupdate.exe

Loads dropped DLL 64 IoCs

Processes:

Xlpzxnsnafub.exeMsiExec.exerundll32.exerundll32.exeMsiExec.exerundll32.exerundll32.exe

pid	process
2756	Xlpzxnsnafub.exe
2756	Xlpzxnsnafub.exe
2756	Xlpzxnsnafub.exe
2756	Xlpzxnsnafub.exe
2756	Xlpzxnsnafub.exe
2756	Xlpzxnsnafub.exe
2756	Xlpzxnsnafub.exe
2756	Xlpzxnsnafub.exe
2756	Xlpzxnsnafub.exe
4448	MsiExec.exe
4508	rundll32.exe
4508	rundll32.exe
4508	rundll32.exe
4508	rundll32.exe
4508	rundll32.exe
4508	rundll32.exe
4508	rundll32.exe
4508	rundll32.exe
4508	rundll32.exe
4508	rundll32.exe
4508	rundll32.exe
4448	MsiExec.exe
4664	rundll32.exe
4664	rundll32.exe
4664	rundll32.exe
4664	rundll32.exe
4664	rundll32.exe
4664	rundll32.exe
4664	rundll32.exe
4664	rundll32.exe
4664	rundll32.exe
4664	rundll32.exe
4664	rundll32.exe
4448	MsiExec.exe
4856	MsiExec.exe
4856	MsiExec.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4936	rundll32.exe
4856	MsiExec.exe
5112	rundll32.exe
5112	rundll32.exe
5112	rundll32.exe
5112	rundll32.exe
5112	rundll32.exe
5112	rundll32.exe
5112	rundll32.exe
5112	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windowsupdate.exeExpressVPN_10.4.1.2.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b2cfa0ba1b27be996957c11e1bf6a214 = "\"C:\\Users\\Admin\\windowsupdate.exe\" .."	windowsupdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ExpressVPN_10.4.1.2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{336616d6-abef-4ff8-9afd-43ceb249ff9a} = "\"C:\\ProgramData\\Package Cache\\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\\ExpressVPN_10.4.1.2.exe\" /burn.runonce"	ExpressVPN_10.4.1.2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ExpressVPNNotificationService = "\"C:\\Program Files (x86)\\ExpressVPN\\expressvpn-ui\\ExpressVPNNotificationServiceStarter.exe\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\b2cfa0ba1b27be996957c11e1bf6a214 = "\"C:\\Users\\Admin\\windowsupdate.exe\" .."	windowsupdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exerundll32.exe

description	ioc	process
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN-Installer.exe	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\wintun\driver\amd64\expressvpn-wintun.sys	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\splittunnel\expressvpnsplittunnel.cat	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\com.expressvpn.helper.firefox.json	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\ExpressVPN.SplitTunnel.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\expressvpnd.exe	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\Sentry.PlatformAbstractions.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\Sentry.Protocol.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVpn.Client.Utils.NamedPipes.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\tap\driver\amd64\OemVista.inf	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\RasUtility.exe	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\tap\driver\amd64\tapexpressvpn.cat	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\44x44Logo.scale-200.png	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\ExpressVPN.Utils.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Management.Automation.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\44x44Logo.scale-400.png	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\RasUtility.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\System.Management.Automation.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\XvUtil.exe	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\70x70Logo.scale-150.png	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ManagedWifi.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\tap\driver\amd64\tapexpressvpn.sys	msiexec.exe
File opened for modification	C:\Program Files (x86)\ExpressVPN\expressvpnd\com.expressvpn.helper.json	rundll32.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\150x150Logo.scale-100.png	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\44x44Logo.scale-150.png	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Caliburn.Micro.Platform.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\log4net.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\ManagedWifi.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Reactive.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\70x70Logo.scale-100.png	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Common.Logging.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\ExpressVPN.FilterManager.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\libxvclient.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Sentry.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Reactive.Interfaces.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\44x44Logo.scale-125.png	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\70x70Logo.scale-400.png	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\HtmlAgilityPack.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\lightway.exe	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\Common.Logging.Log4Net1213.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\ExpressVPN.NetworkUtils.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\Sentry.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\ExpressVPN\expressvpnd\com.expressvpn.helper.firefox.json	rundll32.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\libpkcs11-helper-1.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Reactive.Windows.Threading.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\DotRas.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\ExpressVpn.Utils.Wmi.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\MissingLinq.Linq2Management.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\MissingLinq.Linq2Management.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN.exe	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN-Installer.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\wintun\driver\amd64\expressvpn-wintun.inf	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Hardcodet.Wpf.TaskbarNotification.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\Sentry.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\bootstrap\amd64\nssm.exe	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\xvutil\System.Reactive.Interfaces.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Windows.Interactivity.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Common.Logging.Log4Net1213.dll	msiexec.exe
File created	C:\Program Files (x86)\ExpressVPN\expressvpnd\windows\rasutility\System.Reactive.Interfaces.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

rundll32.exemsiexec.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI61D0.tmp-\MissingLinq.Linq2Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\f753104.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38B4.tmp-\ManagedWifi.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\ExpressVPN.Utils.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\System.Management.Automation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4FDB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A6C.tmp-\ExpressVPN.Client.Installer.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5A6C.tmp-\Sentry.PlatformAbstractions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\ExpressVpn.Utils.Wmi.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\Sentry.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6637.tmp-\Sentry.PlatformAbstractions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI38B4.tmp-\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\WixSharp Setup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5A6C.tmp-\WixSharp Setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5A6C.tmp-\System.Reactive.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI38B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38B4.tmp-\Sentry.PlatformAbstractions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\WixSharp Setup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI61D0.tmp-\System.Reactive.Linq.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6637.tmp-\Common.Logging.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI38B4.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\Common.Logging.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\System.Reactive.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5A6C.tmp-\System.Management.Automation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6637.tmp-\System.Reactive.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI38B4.tmp-\System.Management.Automation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\Common.Logging.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\log4net.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\System.ValueTuple.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6637.tmp-\ManagedWifi.dll	rundll32.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38B4.tmp-\System.Reactive.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\System.Reactive.Core.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\WixSharp.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5A6C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI61D0.tmp-\System.Reactive.Interfaces.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{E5B9C3E5-889C-4F22-A959-F4B8760D8833}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A6C.tmp-\Common.Logging.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6637.tmp-\ExpressVPN.Client.Installer.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6637.tmp-\System.Reactive.Interfaces.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\Sentry.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\MissingLinq.Linq2Management.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5A6C.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5A6C.tmp-\log4net.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI61D0.tmp-\System.ValueTuple.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6637.tmp-\WixSharp Setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6637.tmp-\log4net.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI38B4.tmp-\log4net.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\Sentry.Protocol.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\System.Reactive.Linq.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI38B4.tmp-\Sentry.Protocol.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\WixSharp Setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\WixSharp Setup.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI61D0.tmp-\System.Management.Automation.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6637.tmp-\Sentry.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4344.tmp-\Sentry.PlatformAbstractions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4A3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\Common.Logging.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\log4net.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI55B8.tmp-\System.ValueTuple.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5A6C.tmp-\WixSharp Setup.pdb	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI6637.tmp-\CustomAction.config	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

416 3172 WerFault.exe Cpecf.exe

pid	pid_target	process	target process
416	3172	WerFault.exe	Cpecf.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\HardwareID	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe

Modifies registry class 51 IoCs

Processes:

msiexec.exeExpressVPN_10.4.1.2.exeExpressVPNNotificationService.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\ProductName = "ExpressVPN"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}	ExpressVPN_10.4.1.2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\ = "{336616d6-abef-4ff8-9afd-43ceb249ff9a}"	ExpressVPN_10.4.1.2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E3C9B5EC98822F49A954F8B67D08833\Complete	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\shell\open\command\ = "\"C:\\Program Files (x86)\\ExpressVPN\\expressvpn-ui\\ExpressVPN.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E3C9B5EC98822F49A954F8B6DDC8703	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\ = "{E5B9C3E5-889C-4F22-A959-F4B8760D8833}"	ExpressVPN_10.4.1.2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\expressvpn\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\expressvpn\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\shell\open	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node\CLSID\{3e705353-af85-4ad9-9750-7fb07347eb98}\LocalServer32	ExpressVPNNotificationService.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node	ExpressVPNNotificationService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\DisplayName = "ExpressVPN"	ExpressVPN_10.4.1.2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\PackageName = "ExpressVPN.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}	ExpressVPN_10.4.1.2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\PackageCode = "7E9ECFB1B49175149997F02C809CF213"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5E3C9B5EC98822F49A954F8B6DDC8703\5E3C9B5EC98822F49A954F8B67D08833	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\DisplayName = "ExpressVPN"	ExpressVPN_10.4.1.2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\Dependents	ExpressVPN_10.4.1.2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\Dependents	ExpressVPN_10.4.1.2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\ProductIcon = "C:\\Windows\\Installer\\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\\app_icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}v10.4.1.2\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node\CLSID\{3e705353-af85-4ad9-9750-7fb07347eb98}\LocalServer32\ = "\"C:\\Program Files (x86)\\ExpressVPN\\expressvpn-ui\\ExpressVPNNotificationService.exe\" -ToastActivated"	ExpressVPNNotificationService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\Version = "10.4.1.2"	ExpressVPN_10.4.1.2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\shell	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\Version = "168034305"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node\CLSID\{3e705353-af85-4ad9-9750-7fb07347eb98}	ExpressVPNNotificationService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5E3C9B5EC98822F49A954F8B67D08833	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\WOW6432Node\CLSID	ExpressVPNNotificationService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\DefaultIcon\ = "\"C:\\Program Files (x86)\\ExpressVPN\\expressvpn-ui\\ExpressVPN.exe,1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{336616d6-abef-4ff8-9afd-43ceb249ff9a}\Dependents\{336616d6-abef-4ff8-9afd-43ceb249ff9a}	ExpressVPN_10.4.1.2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\Version = "10.4.1.2"	ExpressVPN_10.4.1.2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\expressvpn	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\ = "URL:ExpressVPN Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5E3C9B5EC98822F49A954F8B67D08833\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}v10.4.1.2\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8760D8833}\Dependents\{336616d6-abef-4ff8-9afd-43ceb249ff9a}	ExpressVPN_10.4.1.2.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

ExpressVPN.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ExpressVPN.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ExpressVPN.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ExpressVPN.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

Cpecf.exeWerFault.exemsiexec.exeMsiExec.exeExpressVPN.exe

pid	process
3172	Cpecf.exe
3172	Cpecf.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
416	WerFault.exe
4192	msiexec.exe
4192	msiexec.exe
4856	MsiExec.exe
4856	MsiExec.exe
4796	ExpressVPN.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Cpecf.exevssvc.exeWerFault.exewindowsupdate.exeExpressVPN_10.4.1.2.exemsiexec.exesrtasks.exe

description	pid	process
Token: SeDebugPrivilege	3172	Cpecf.exe
Token: SeBackupPrivilege	3488	vssvc.exe
Token: SeRestorePrivilege	3488	vssvc.exe
Token: SeAuditPrivilege	3488	vssvc.exe
Token: SeDebugPrivilege	416	WerFault.exe
Token: SeDebugPrivilege	2324	windowsupdate.exe
Token: 33	2324	windowsupdate.exe
Token: SeIncBasePriorityPrivilege	2324	windowsupdate.exe
Token: SeShutdownPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeIncreaseQuotaPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeSecurityPrivilege	4192	msiexec.exe
Token: SeCreateTokenPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeAssignPrimaryTokenPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeLockMemoryPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeIncreaseQuotaPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeMachineAccountPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeTcbPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeSecurityPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeTakeOwnershipPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeLoadDriverPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeSystemProfilePrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeSystemtimePrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeProfSingleProcessPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeIncBasePriorityPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeCreatePagefilePrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeCreatePermanentPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeBackupPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeRestorePrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeShutdownPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeDebugPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeAuditPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeSystemEnvironmentPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeChangeNotifyPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeRemoteShutdownPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeUndockPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeSyncAgentPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeEnableDelegationPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeManageVolumePrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeImpersonatePrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeCreateGlobalPrivilege	4084	ExpressVPN_10.4.1.2.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: 33	2324	windowsupdate.exe
Token: SeIncBasePriorityPrivilege	2324	windowsupdate.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeBackupPrivilege	4116	srtasks.exe
Token: SeRestorePrivilege	4116	srtasks.exe
Token: SeSecurityPrivilege	4116	srtasks.exe
Token: SeTakeOwnershipPrivilege	4116	srtasks.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeBackupPrivilege	4116	srtasks.exe
Token: SeRestorePrivilege	4116	srtasks.exe
Token: SeSecurityPrivilege	4116	srtasks.exe
Token: SeTakeOwnershipPrivilege	4116	srtasks.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe
Token: SeRestorePrivilege	4192	msiexec.exe
Token: SeTakeOwnershipPrivilege	4192	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

ExpressVPN.exe

pid process

4796 ExpressVPN.exe
4796 ExpressVPN.exe
4796 ExpressVPN.exe
4796 ExpressVPN.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

ExpressVPN.exe

pid process

4796 ExpressVPN.exe
4796 ExpressVPN.exe
4796 ExpressVPN.exe

pid	process
4796	ExpressVPN.exe
4796	ExpressVPN.exe
4796	ExpressVPN.exe
4796	ExpressVPN.exe

pid	process
4796	ExpressVPN.exe
4796	ExpressVPN.exe
4796	ExpressVPN.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

Express Vpn Cracked.exeXlpzxnsnafub.exeActg.exeXlpzxnsnafub.exewindowsupdate.exemsiexec.exeMsiExec.exeMsiExec.exesvchost.exeExpressVPN.exe

description	pid	process	target process
PID 860 wrote to memory of 768	860	Express Vpn Cracked.exe	Actg.exe
PID 860 wrote to memory of 768	860	Express Vpn Cracked.exe	Actg.exe
PID 860 wrote to memory of 768	860	Express Vpn Cracked.exe	Actg.exe
PID 860 wrote to memory of 3172	860	Express Vpn Cracked.exe	Cpecf.exe
PID 860 wrote to memory of 3172	860	Express Vpn Cracked.exe	Cpecf.exe
PID 860 wrote to memory of 3940	860	Express Vpn Cracked.exe	Xlpzxnsnafub.exe
PID 860 wrote to memory of 3940	860	Express Vpn Cracked.exe	Xlpzxnsnafub.exe
PID 860 wrote to memory of 3940	860	Express Vpn Cracked.exe	Xlpzxnsnafub.exe
PID 3940 wrote to memory of 2756	3940	Xlpzxnsnafub.exe	Xlpzxnsnafub.exe
PID 3940 wrote to memory of 2756	3940	Xlpzxnsnafub.exe	Xlpzxnsnafub.exe
PID 3940 wrote to memory of 2756	3940	Xlpzxnsnafub.exe	Xlpzxnsnafub.exe
PID 768 wrote to memory of 2324	768	Actg.exe	windowsupdate.exe
PID 768 wrote to memory of 2324	768	Actg.exe	windowsupdate.exe
PID 768 wrote to memory of 2324	768	Actg.exe	windowsupdate.exe
PID 2756 wrote to memory of 4084	2756	Xlpzxnsnafub.exe	ExpressVPN_10.4.1.2.exe
PID 2756 wrote to memory of 4084	2756	Xlpzxnsnafub.exe	ExpressVPN_10.4.1.2.exe
PID 2756 wrote to memory of 4084	2756	Xlpzxnsnafub.exe	ExpressVPN_10.4.1.2.exe
PID 2324 wrote to memory of 1000	2324	windowsupdate.exe	netsh.exe
PID 2324 wrote to memory of 1000	2324	windowsupdate.exe	netsh.exe
PID 2324 wrote to memory of 1000	2324	windowsupdate.exe	netsh.exe
PID 4192 wrote to memory of 4448	4192	msiexec.exe	MsiExec.exe
PID 4192 wrote to memory of 4448	4192	msiexec.exe	MsiExec.exe
PID 4192 wrote to memory of 4448	4192	msiexec.exe	MsiExec.exe
PID 4448 wrote to memory of 4508	4448	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4508	4448	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4508	4448	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4664	4448	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4664	4448	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4664	4448	MsiExec.exe	rundll32.exe
PID 4192 wrote to memory of 4856	4192	msiexec.exe	MsiExec.exe
PID 4192 wrote to memory of 4856	4192	msiexec.exe	MsiExec.exe
PID 4192 wrote to memory of 4856	4192	msiexec.exe	MsiExec.exe
PID 4856 wrote to memory of 4936	4856	MsiExec.exe	rundll32.exe
PID 4856 wrote to memory of 4936	4856	MsiExec.exe	rundll32.exe
PID 4856 wrote to memory of 4936	4856	MsiExec.exe	rundll32.exe
PID 4856 wrote to memory of 5112	4856	MsiExec.exe	rundll32.exe
PID 4856 wrote to memory of 5112	4856	MsiExec.exe	rundll32.exe
PID 4856 wrote to memory of 5112	4856	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4380	4448	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4380	4448	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4380	4448	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4572	4448	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4572	4448	MsiExec.exe	rundll32.exe
PID 4448 wrote to memory of 4572	4448	MsiExec.exe	rundll32.exe
PID 4752 wrote to memory of 4796	4752	svchost.exe	ExpressVPN.exe
PID 4752 wrote to memory of 4796	4752	svchost.exe	ExpressVPN.exe
PID 4752 wrote to memory of 4796	4752	svchost.exe	ExpressVPN.exe
PID 4752 wrote to memory of 4816	4752	svchost.exe	ExpressVPNNotificationService.exe
PID 4752 wrote to memory of 4816	4752	svchost.exe	ExpressVPNNotificationService.exe
PID 4752 wrote to memory of 4816	4752	svchost.exe	ExpressVPNNotificationService.exe
PID 4796 wrote to memory of 4688	4796	ExpressVPN.exe	ExpressVPNNotificationService.exe
PID 4796 wrote to memory of 4688	4796	ExpressVPN.exe	ExpressVPNNotificationService.exe
PID 4796 wrote to memory of 4688	4796	ExpressVPN.exe	ExpressVPNNotificationService.exe

C:\Users\Admin\AppData\Local\Temp\Express Vpn Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\Express Vpn Cracked.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:860

C:\Users\Admin\AppData\Local\Temp\Actg.exe
"C:\Users\Admin\AppData\Local\Temp\Actg.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768

C:\Users\Admin\windowsupdate.exe
"C:\Users\Admin\windowsupdate.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\windowsupdate.exe" "windowsupdate.exe" ENABLE
4⤵
PID:1000

C:\Users\Admin\AppData\Local\Temp\Cpecf.exe
"C:\Users\Admin\AppData\Local\Temp\Cpecf.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3172 -s 1080
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:416

C:\Users\Admin\AppData\Local\Temp\Xlpzxnsnafub.exe
"C:\Users\Admin\AppData\Local\Temp\Xlpzxnsnafub.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940

C:\Windows\Temp\{655AF3CA-6185-4F85-B650-DB153A7A1ED4}\.cr\Xlpzxnsnafub.exe
"C:\Windows\Temp\{655AF3CA-6185-4F85-B650-DB153A7A1ED4}\.cr\Xlpzxnsnafub.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Xlpzxnsnafub.exe" -burn.filehandle.attached=524 -burn.filehandle.self=532
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.be\ExpressVPN_10.4.1.2.exe
"C:\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.be\ExpressVPN_10.4.1.2.exe" -q -burn.elevated BurnPipe.{92007EC6-90CD-4187-9CCF-F8EE6A39FE74} {58A6CB07-1805-4F94-8D4A-A3CF58B5ABCC} 2756
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4084

C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN.exe
"C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN.exe" install
4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796

C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPNNotificationService.exe
"C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPNNotificationService.exe" uihaslaunched
5⤵
- Executes dropped EXE
PID:4688

C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPNNotificationService.exe
"C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPNNotificationService.exe"
4⤵
- Executes dropped EXE
- Modifies registry class
PID:4816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3488

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1208

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4192

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding A7A1BF9756D622047BCFD61F1890DEE0
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4448

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI38B4.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259341531 2 WixSharp Setup!ExpressVpn.Client.Setup.Actions.SetWin10
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4508

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI4344.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259343234 6 WixSharp Setup!ExpressVpn.Client.Setup.Actions.SetWindowsBuild
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4664

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI61D0.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259351062 28 WixSharp Setup!ExpressVpn.Client.Setup.Actions.RemoveUserFolderData
3⤵
- Drops file in Windows directory
PID:4380

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI6637.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259352203 38 WixSharp Setup!ExpressVpn.Client.Setup.Actions.DeleteBinaries
3⤵
- Drops file in Windows directory
PID:4572

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 472C6A97ECB7085AA25EA6BBCDC562B9 E Global\MSI0000
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI55B8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259348031 18 WixSharp Setup!ExpressVpn.Client.Setup.Actions.GenerateToken
3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4936

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Windows\Installer\MSI5A6C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259349156 24 WixSharp Setup!ExpressVpn.Client.Setup.Actions.SetBrowserHelperPath
3⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5112

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4752

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rundll32.exe.log
MD5
47c6667a0d9d4bdb4e5215578054c0d6

SHA1
56f494a719ad3cf29723458166d9831719941fa4

SHA256
b2526c381832cbe24e8f0d14bb7dbf8e9ab753e087a2f9b7d6b8e36065672355

SHA512
7af086ffeee540b70efd190db4b77867356452d2b22904665d6fb53fa0b3749cba6f0613cb96134bed91ba2fa80bf4cced1d8af28679d27f230748fc0d38e5e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Actg.exe
MD5
173f905dbe88ebe490e78956b75b1f44

SHA1
7a138d6771fc30124810984c1ba9f5c59533331f

SHA256
094b72206ae5013037de2de5fc6ee72b978a6c94f6aaa2097294c961969bc761

SHA512
2e22eda3d1bbf07b475f7c295ab5ab7379bb8191336dfdf2ea147b26d88cec34b47eaffacbbc3561bb7f60a35f72433a7c62f37b98f4c3e5a76134b7ab7ee2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Actg.exe
MD5
173f905dbe88ebe490e78956b75b1f44

SHA1
7a138d6771fc30124810984c1ba9f5c59533331f

SHA256
094b72206ae5013037de2de5fc6ee72b978a6c94f6aaa2097294c961969bc761

SHA512
2e22eda3d1bbf07b475f7c295ab5ab7379bb8191336dfdf2ea147b26d88cec34b47eaffacbbc3561bb7f60a35f72433a7c62f37b98f4c3e5a76134b7ab7ee2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cpecf.exe
MD5
fdad75d3ffdc8e86442e86c59b0e4746

SHA1
f37fc124761d78d834b3f0b01724f3aaf15654f4

SHA256
f9fa4e1d6a6ce8b85547c0194433a5636106adff2f75cb6d3b8ee0b6c63c5bbf

SHA512
75261118938e438338b0de8dde5d6477740d21c5211be6f89611d0c9644a7f923db69aa6adc352c263fcd1cf71bda2bbba6e8b7f8ad95cb6e8a033cb75a03cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cpecf.exe
MD5
fdad75d3ffdc8e86442e86c59b0e4746

SHA1
f37fc124761d78d834b3f0b01724f3aaf15654f4

SHA256
f9fa4e1d6a6ce8b85547c0194433a5636106adff2f75cb6d3b8ee0b6c63c5bbf

SHA512
75261118938e438338b0de8dde5d6477740d21c5211be6f89611d0c9644a7f923db69aa6adc352c263fcd1cf71bda2bbba6e8b7f8ad95cb6e8a033cb75a03cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ExpressVPN_20210807192254_000_MainMsi.log
MD5
c1b7bfb52c17ef8966cf54f5a3b217b1

SHA1
154a0d039a4475c16d4109a5f2f1b4ad2db12a6e

SHA256
da09816b5e855050335de9bedcfc02f6d11c4d92d3929b603d8e44cb3814a8c8

SHA512
5fe88cd0c7d3c0fa2688aa46069cfa6cad0d546f12f0bc7baa312ffbecbaf2cf4694f444449e578c2965db2261156dd5bb64dbd1ab20ef9f8bd036a7939b9343

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xlpzxnsnafub.exe
MD5
e0659494c5b27f2bef8c91eed5b8d34e

SHA1
5b9fe6c75be4b1982154dfda3b621d562c9e0ee6

SHA256
f52702b198a2ea5f46613b69bd1eb5069f79c7ccb02194187d27f1f5f561d2c4

SHA512
65e650946a69f2271b1deff4882c0a7c4d61e57a5feaae6cd3c866353ab6b24dde78831dfe980dae7443338b4c83d78120e9d3b342b1e391b3522db9af7dc05f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Xlpzxnsnafub.exe
MD5
e0659494c5b27f2bef8c91eed5b8d34e

SHA1
5b9fe6c75be4b1982154dfda3b621d562c9e0ee6

SHA256
f52702b198a2ea5f46613b69bd1eb5069f79c7ccb02194187d27f1f5f561d2c4

SHA512
65e650946a69f2271b1deff4882c0a7c4d61e57a5feaae6cd3c866353ab6b24dde78831dfe980dae7443338b4c83d78120e9d3b342b1e391b3522db9af7dc05f

Download Submit
C:\Users\Admin\windowsupdate.exe
MD5
173f905dbe88ebe490e78956b75b1f44

SHA1
7a138d6771fc30124810984c1ba9f5c59533331f

SHA256
094b72206ae5013037de2de5fc6ee72b978a6c94f6aaa2097294c961969bc761

SHA512
2e22eda3d1bbf07b475f7c295ab5ab7379bb8191336dfdf2ea147b26d88cec34b47eaffacbbc3561bb7f60a35f72433a7c62f37b98f4c3e5a76134b7ab7ee2af

Download Submit
C:\Users\Admin\windowsupdate.exe
MD5
173f905dbe88ebe490e78956b75b1f44

SHA1
7a138d6771fc30124810984c1ba9f5c59533331f

SHA256
094b72206ae5013037de2de5fc6ee72b978a6c94f6aaa2097294c961969bc761

SHA512
2e22eda3d1bbf07b475f7c295ab5ab7379bb8191336dfdf2ea147b26d88cec34b47eaffacbbc3561bb7f60a35f72433a7c62f37b98f4c3e5a76134b7ab7ee2af

Download Submit
C:\Windows\Installer\MSI38B4.tmp
MD5
39c3069addf8da0932e5eeaab2aa73da

SHA1
df90ef15de2d91211fd6f58deeddf144de8f37cc

SHA256
6b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4

SHA512
e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920

Download Submit
C:\Windows\Installer\MSI4344.tmp
MD5
39c3069addf8da0932e5eeaab2aa73da

SHA1
df90ef15de2d91211fd6f58deeddf144de8f37cc

SHA256
6b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4

SHA512
e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920

Download Submit
C:\Windows\Installer\MSI4A3C.tmp
MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI4FDB.tmp
MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Installer\MSI55B8.tmp
MD5
39c3069addf8da0932e5eeaab2aa73da

SHA1
df90ef15de2d91211fd6f58deeddf144de8f37cc

SHA256
6b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4

SHA512
e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920

Download Submit
C:\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.be\ExpressVPN_10.4.1.2.exe
MD5
013dbe59ad341d18dd156ffde8c5afd8

SHA1
c5afbf4233e8ddc7a42b4c53a2bff2799fc2a369

SHA256
d552cda9a12a49320cd11afcc185309ff14461cfdc6231b6792cd770f69a817a

SHA512
cd87767db1597a17aa38ba9d93f69cc9134de613c8434ac59a765940d23a377f4a17afed93f9e10ffcd835ad77fd5a0a6e94794b0ccf585afce0fe41951c60ff

Download Submit
C:\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.be\ExpressVPN_10.4.1.2.exe
MD5
013dbe59ad341d18dd156ffde8c5afd8

SHA1
c5afbf4233e8ddc7a42b4c53a2bff2799fc2a369

SHA256
d552cda9a12a49320cd11afcc185309ff14461cfdc6231b6792cd770f69a817a

SHA512
cd87767db1597a17aa38ba9d93f69cc9134de613c8434ac59a765940d23a377f4a17afed93f9e10ffcd835ad77fd5a0a6e94794b0ccf585afce0fe41951c60ff

Download Submit
C:\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\MainMsi
MD5
ad0376bc99575c74b24a3a853d2b2108

SHA1
a39f23d5a797c02a1ad9ee52f64bbc3eb0b2c420

SHA256
b4d829687464f819f1635d1de79959b99eb73ee4a5acb0705272c94f17fe1516

SHA512
04b71ae871d37835c3ac96e91775fa029119e2733c58115758c72b331574b6559c67324239a2d0731fb46ab2e7b46a3a6685f905b616d2a782423e45a91139cc

Download Submit
C:\Windows\Temp\{655AF3CA-6185-4F85-B650-DB153A7A1ED4}\.cr\Xlpzxnsnafub.exe
MD5
013dbe59ad341d18dd156ffde8c5afd8

SHA1
c5afbf4233e8ddc7a42b4c53a2bff2799fc2a369

SHA256
d552cda9a12a49320cd11afcc185309ff14461cfdc6231b6792cd770f69a817a

SHA512
cd87767db1597a17aa38ba9d93f69cc9134de613c8434ac59a765940d23a377f4a17afed93f9e10ffcd835ad77fd5a0a6e94794b0ccf585afce0fe41951c60ff

Download Submit
C:\Windows\Temp\{655AF3CA-6185-4F85-B650-DB153A7A1ED4}\.cr\Xlpzxnsnafub.exe
MD5
013dbe59ad341d18dd156ffde8c5afd8

SHA1
c5afbf4233e8ddc7a42b4c53a2bff2799fc2a369

SHA256
d552cda9a12a49320cd11afcc185309ff14461cfdc6231b6792cd770f69a817a

SHA512
cd87767db1597a17aa38ba9d93f69cc9134de613c8434ac59a765940d23a377f4a17afed93f9e10ffcd835ad77fd5a0a6e94794b0ccf585afce0fe41951c60ff

Download Submit
\Windows\Installer\MSI38B4.tmp
MD5
39c3069addf8da0932e5eeaab2aa73da

SHA1
df90ef15de2d91211fd6f58deeddf144de8f37cc

SHA256
6b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4

SHA512
e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920

Download Submit
\Windows\Installer\MSI38B4.tmp
MD5
39c3069addf8da0932e5eeaab2aa73da

SHA1
df90ef15de2d91211fd6f58deeddf144de8f37cc

SHA256
6b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4

SHA512
e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920

Download Submit
\Windows\Installer\MSI38B4.tmp-\Common.Logging.Core.dll
MD5
314445e176cd8ccfe3cf274c263e2cdc

SHA1
df6730124e7b1a288f97cb7fdbabf53481379235

SHA256
3d806326bfce9ddacdd922bdf9c96e45de9172f45a8a0af4cc515381cea01984

SHA512
da14d68cfe5218fc98e12cbb18bb8ba56843e7b9a4f20c302d3980171d4107a2492eb9ff27799924541de8629bc037572bb29c6f87fd908b1f5bc6d68d26e1bc

Download Submit
\Windows\Installer\MSI38B4.tmp-\Common.Logging.Core.dll
MD5
314445e176cd8ccfe3cf274c263e2cdc

SHA1
df6730124e7b1a288f97cb7fdbabf53481379235

SHA256
3d806326bfce9ddacdd922bdf9c96e45de9172f45a8a0af4cc515381cea01984

SHA512
da14d68cfe5218fc98e12cbb18bb8ba56843e7b9a4f20c302d3980171d4107a2492eb9ff27799924541de8629bc037572bb29c6f87fd908b1f5bc6d68d26e1bc

Download Submit
\Windows\Installer\MSI38B4.tmp-\Common.Logging.dll
MD5
9d7f9e7a508452626cc8a4a735a65819

SHA1
97d55bcae5ed46270e092515276bedddaa7a0533

SHA256
2155289b62e2a05c322f7eb23ffb9f87fe48923bec12722a117d00857370bb0e

SHA512
f41f15488fb791fa7af978a439b2eadefaf66ca0cf8f1a915f186b45dd401db02a6fb65c177c390e7b570e24c03d26061abc4511d154dc9b2ddef0305f503595

Download Submit
\Windows\Installer\MSI38B4.tmp-\Common.Logging.dll
MD5
9d7f9e7a508452626cc8a4a735a65819

SHA1
97d55bcae5ed46270e092515276bedddaa7a0533

SHA256
2155289b62e2a05c322f7eb23ffb9f87fe48923bec12722a117d00857370bb0e

SHA512
f41f15488fb791fa7af978a439b2eadefaf66ca0cf8f1a915f186b45dd401db02a6fb65c177c390e7b570e24c03d26061abc4511d154dc9b2ddef0305f503595

Download Submit
\Windows\Installer\MSI38B4.tmp-\ExpressVPN.Utils.dll
MD5
00059169c1323addd07e77f36b2d6ac4

SHA1
822bf8d5ebad1f4604e98dcf2a2ee4945c36bcbe

SHA256
2cedb1f3f8584b739138dcc95364d34b88d19ba121a1582e4ddc36f3fd35c1c9

SHA512
afc37ad026e2e375348c4385f5c5aaf6eb7030e05d9bb7370bca38d459b0a7626888bb6826d6d4f9ab6e804c03bdf3472503c980451205b568bebe30002027a5

Download Submit
\Windows\Installer\MSI38B4.tmp-\ExpressVPN.Utils.dll
MD5
00059169c1323addd07e77f36b2d6ac4

SHA1
822bf8d5ebad1f4604e98dcf2a2ee4945c36bcbe

SHA256
2cedb1f3f8584b739138dcc95364d34b88d19ba121a1582e4ddc36f3fd35c1c9

SHA512
afc37ad026e2e375348c4385f5c5aaf6eb7030e05d9bb7370bca38d459b0a7626888bb6826d6d4f9ab6e804c03bdf3472503c980451205b568bebe30002027a5

Download Submit
\Windows\Installer\MSI38B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll
MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSI38B4.tmp-\Microsoft.Deployment.WindowsInstaller.dll
MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSI38B4.tmp-\WixSharp Setup.exe
MD5
8ba372785d5ab303bf4ac6884a1ee2a1

SHA1
9a92d202dc604adbc553016e7a9c3750e3646328

SHA256
41ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83

SHA512
1c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d

Download Submit
\Windows\Installer\MSI38B4.tmp-\WixSharp Setup.exe
MD5
8ba372785d5ab303bf4ac6884a1ee2a1

SHA1
9a92d202dc604adbc553016e7a9c3750e3646328

SHA256
41ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83

SHA512
1c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d

Download Submit
\Windows\Installer\MSI4344.tmp
MD5
39c3069addf8da0932e5eeaab2aa73da

SHA1
df90ef15de2d91211fd6f58deeddf144de8f37cc

SHA256
6b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4

SHA512
e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920

Download Submit
\Windows\Installer\MSI4344.tmp
MD5
39c3069addf8da0932e5eeaab2aa73da

SHA1
df90ef15de2d91211fd6f58deeddf144de8f37cc

SHA256
6b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4

SHA512
e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920

Download Submit
\Windows\Installer\MSI4344.tmp-\Common.Logging.Core.dll
MD5
314445e176cd8ccfe3cf274c263e2cdc

SHA1
df6730124e7b1a288f97cb7fdbabf53481379235

SHA256
3d806326bfce9ddacdd922bdf9c96e45de9172f45a8a0af4cc515381cea01984

SHA512
da14d68cfe5218fc98e12cbb18bb8ba56843e7b9a4f20c302d3980171d4107a2492eb9ff27799924541de8629bc037572bb29c6f87fd908b1f5bc6d68d26e1bc

Download Submit
\Windows\Installer\MSI4344.tmp-\Common.Logging.Core.dll
MD5
314445e176cd8ccfe3cf274c263e2cdc

SHA1
df6730124e7b1a288f97cb7fdbabf53481379235

SHA256
3d806326bfce9ddacdd922bdf9c96e45de9172f45a8a0af4cc515381cea01984

SHA512
da14d68cfe5218fc98e12cbb18bb8ba56843e7b9a4f20c302d3980171d4107a2492eb9ff27799924541de8629bc037572bb29c6f87fd908b1f5bc6d68d26e1bc

Download Submit
\Windows\Installer\MSI4344.tmp-\Common.Logging.dll
MD5
9d7f9e7a508452626cc8a4a735a65819

SHA1
97d55bcae5ed46270e092515276bedddaa7a0533

SHA256
2155289b62e2a05c322f7eb23ffb9f87fe48923bec12722a117d00857370bb0e

SHA512
f41f15488fb791fa7af978a439b2eadefaf66ca0cf8f1a915f186b45dd401db02a6fb65c177c390e7b570e24c03d26061abc4511d154dc9b2ddef0305f503595

Download Submit
\Windows\Installer\MSI4344.tmp-\Common.Logging.dll
MD5
9d7f9e7a508452626cc8a4a735a65819

SHA1
97d55bcae5ed46270e092515276bedddaa7a0533

SHA256
2155289b62e2a05c322f7eb23ffb9f87fe48923bec12722a117d00857370bb0e

SHA512
f41f15488fb791fa7af978a439b2eadefaf66ca0cf8f1a915f186b45dd401db02a6fb65c177c390e7b570e24c03d26061abc4511d154dc9b2ddef0305f503595

Download Submit
\Windows\Installer\MSI4344.tmp-\ExpressVPN.Utils.dll
MD5
00059169c1323addd07e77f36b2d6ac4

SHA1
822bf8d5ebad1f4604e98dcf2a2ee4945c36bcbe

SHA256
2cedb1f3f8584b739138dcc95364d34b88d19ba121a1582e4ddc36f3fd35c1c9

SHA512
afc37ad026e2e375348c4385f5c5aaf6eb7030e05d9bb7370bca38d459b0a7626888bb6826d6d4f9ab6e804c03bdf3472503c980451205b568bebe30002027a5

Download Submit
\Windows\Installer\MSI4344.tmp-\ExpressVPN.Utils.dll
MD5
00059169c1323addd07e77f36b2d6ac4

SHA1
822bf8d5ebad1f4604e98dcf2a2ee4945c36bcbe

SHA256
2cedb1f3f8584b739138dcc95364d34b88d19ba121a1582e4ddc36f3fd35c1c9

SHA512
afc37ad026e2e375348c4385f5c5aaf6eb7030e05d9bb7370bca38d459b0a7626888bb6826d6d4f9ab6e804c03bdf3472503c980451205b568bebe30002027a5

Download Submit
\Windows\Installer\MSI4344.tmp-\Microsoft.Deployment.WindowsInstaller.dll
MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSI4344.tmp-\Microsoft.Deployment.WindowsInstaller.dll
MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSI4344.tmp-\WixSharp Setup.exe
MD5
8ba372785d5ab303bf4ac6884a1ee2a1

SHA1
9a92d202dc604adbc553016e7a9c3750e3646328

SHA256
41ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83

SHA512
1c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d

Download Submit
\Windows\Installer\MSI4344.tmp-\WixSharp Setup.exe
MD5
8ba372785d5ab303bf4ac6884a1ee2a1

SHA1
9a92d202dc604adbc553016e7a9c3750e3646328

SHA256
41ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83

SHA512
1c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d

Download Submit
\Windows\Installer\MSI4A3C.tmp
MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
\Windows\Installer\MSI4FDB.tmp
MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
\Windows\Installer\MSI55B8.tmp
MD5
39c3069addf8da0932e5eeaab2aa73da

SHA1
df90ef15de2d91211fd6f58deeddf144de8f37cc

SHA256
6b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4

SHA512
e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920

Download Submit
\Windows\Installer\MSI55B8.tmp
MD5
39c3069addf8da0932e5eeaab2aa73da

SHA1
df90ef15de2d91211fd6f58deeddf144de8f37cc

SHA256
6b37390fe2a3e48bc6f528bd5e0d67d281eca774fadf3b1945ef000c81cc47f4

SHA512
e943eaf0439c0c5770f78f97226b2718583f7929b6ca9c47793459496b7b949aaccbc5439e3d244ef1c59c19ff0f8eecb6d19e12a0b2c3cb9c45ef5e7a0be920

Download Submit
\Windows\Installer\MSI55B8.tmp-\ExpressVpn.Client.Setup.CustomActions.dll
MD5
cc4d98300b486281895153521a98c35b

SHA1
a109edbd7872b192b2bc853530640484fe5103b9

SHA256
bf0269d1de71a01e7d5e83c6145242e00193883873fa5b57505954cfe92f00c1

SHA512
f1196c0bc1dc5cdb945db0618e685a2a89d9da58f5e1c78d3152c45a9e4985b1eeeda1bd5694a4a3126880977bed67aaeecebf4699fc376704a68cb36f4d83a1

Download Submit
\Windows\Installer\MSI55B8.tmp-\ExpressVpn.Client.Setup.CustomActions.dll
MD5
cc4d98300b486281895153521a98c35b

SHA1
a109edbd7872b192b2bc853530640484fe5103b9

SHA256
bf0269d1de71a01e7d5e83c6145242e00193883873fa5b57505954cfe92f00c1

SHA512
f1196c0bc1dc5cdb945db0618e685a2a89d9da58f5e1c78d3152c45a9e4985b1eeeda1bd5694a4a3126880977bed67aaeecebf4699fc376704a68cb36f4d83a1

Download Submit
\Windows\Installer\MSI55B8.tmp-\Microsoft.Deployment.WindowsInstaller.dll
MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSI55B8.tmp-\Microsoft.Deployment.WindowsInstaller.dll
MD5
1a5caea6734fdd07caa514c3f3fb75da

SHA1
f070ac0d91bd337d7952abd1ddf19a737b94510c

SHA256
cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca

SHA512
a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

Download Submit
\Windows\Installer\MSI55B8.tmp-\WixSharp Setup.exe
MD5
8ba372785d5ab303bf4ac6884a1ee2a1

SHA1
9a92d202dc604adbc553016e7a9c3750e3646328

SHA256
41ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83

SHA512
1c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d

Download Submit
\Windows\Installer\MSI55B8.tmp-\WixSharp Setup.exe
MD5
8ba372785d5ab303bf4ac6884a1ee2a1

SHA1
9a92d202dc604adbc553016e7a9c3750e3646328

SHA256
41ae460239c636410ce73de45c24f2837d6e0b3927ef02ca214c55a8c97a1a83

SHA512
1c3fe54bd544bd32a0a4648098f55d6b93cdc41dac64f36c5d54fbfc2084e22045db93b237f6cea75c042fb413997dbaebfbf089949a7c0057f512dca0c2450d

Download Submit
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\BootstrapperCore.dll
MD5
b0d10a2a622a322788780e7a3cbb85f3

SHA1
04d90b16fa7b47a545c1133d5c0ca9e490f54633

SHA256
f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

SHA512
62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

Download Submit
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\BootstrapperCore.dll
MD5
b0d10a2a622a322788780e7a3cbb85f3

SHA1
04d90b16fa7b47a545c1133d5c0ca9e490f54633

SHA256
f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426

SHA512
62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

Download Submit
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\Castle.Core.dll
MD5
d081621aef9edbb8f2d31f8b3ab9350b

SHA1
806b52922f775b7d69087cc0a8bd3a4f692d48aa

SHA256
80f311adaed94d41436f9a00cbb3f7b010107c7ba4e445fde8a5e9ecc42bb8ba

SHA512
9068bc9762aba9cab6e84c775de8ce9976221d8483dbff3b5c22669a873127241e8d15ece897e31c4a7da8a2bc60f58ef24aae93710dde4e79f72fd088762120

Download Submit
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\Castle.Core.dll
MD5
d081621aef9edbb8f2d31f8b3ab9350b

SHA1
806b52922f775b7d69087cc0a8bd3a4f692d48aa

SHA256
80f311adaed94d41436f9a00cbb3f7b010107c7ba4e445fde8a5e9ecc42bb8ba

SHA512
9068bc9762aba9cab6e84c775de8ce9976221d8483dbff3b5c22669a873127241e8d15ece897e31c4a7da8a2bc60f58ef24aae93710dde4e79f72fd088762120

Download Submit
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\Castle.Windsor.dll
MD5
60e8943d1e726dd45a9efc1530bee9c2

SHA1
823e37faaa969768525163d84657780fa598fbd6

SHA256
289976e538e8cb98d4e41640f120dd1044cd6479e97bb1768c96e6201ece09c5

SHA512
1a0a30c2a49b49cd1067e1364d1e327bc2c5a2046e06898336596849f27462af027cb49814a89b3a8b90f90404b86b83a58a5612c32c1162ac93d7c80ffe01c7

Download Submit
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\Castle.Windsor.dll
MD5
60e8943d1e726dd45a9efc1530bee9c2

SHA1
823e37faaa969768525163d84657780fa598fbd6

SHA256
289976e538e8cb98d4e41640f120dd1044cd6479e97bb1768c96e6201ece09c5

SHA512
1a0a30c2a49b49cd1067e1364d1e327bc2c5a2046e06898336596849f27462af027cb49814a89b3a8b90f90404b86b83a58a5612c32c1162ac93d7c80ffe01c7

Download Submit
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\WixSharp Setup.exe
MD5
7dc9a7ab0616a027ce1dad2e18c6ec1c

SHA1
0d581fd72c3625949fad02d59e7ae9d07ae2eb7c

SHA256
2144b22436751ca1160d760d81e31689c372e6a83f54a6a503abb6101468de81

SHA512
561c37cba8243da41831f714ce10bca35d7d0451406c1c53515469c9be17c21b671778407deb802724b87b09092d628c2ef7e6117925995fb4a55fd17ce85e97

Download Submit
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\WixSharp Setup.exe
MD5
7dc9a7ab0616a027ce1dad2e18c6ec1c

SHA1
0d581fd72c3625949fad02d59e7ae9d07ae2eb7c

SHA256
2144b22436751ca1160d760d81e31689c372e6a83f54a6a503abb6101468de81

SHA512
561c37cba8243da41831f714ce10bca35d7d0451406c1c53515469c9be17c21b671778407deb802724b87b09092d628c2ef7e6117925995fb4a55fd17ce85e97

Download Submit
\Windows\Temp\{5F6EB02E-67F0-4B8B-B13F-AC30B2B031C9}\.ba\mbahost.dll
MD5
c59832217903ce88793a6c40888e3cae

SHA1
6d9facabf41dcf53281897764d467696780623b8

SHA256
9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db

SHA512
1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9

Download Submit
memory/768-129-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/768-117-0x0000000000000000-mapping.dmp

Download
memory/860-114-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/860-116-0x0000000004630000-0x0000000004632000-memory.dmp

Filesize
8KB

Download
memory/1000-164-0x0000000000000000-mapping.dmp

Download
memory/2324-156-0x0000000000000000-mapping.dmp

Download
memory/2324-159-0x0000000001680000-0x0000000001681000-memory.dmp

Filesize
4KB

Download
memory/2756-154-0x0000000007870000-0x0000000007871000-memory.dmp

Filesize
4KB

Download
memory/2756-148-0x0000000006FE0000-0x0000000006FE1000-memory.dmp

Filesize
4KB

Download
memory/2756-155-0x000000000A210000-0x000000000A211000-memory.dmp

Filesize
4KB

Download
memory/2756-153-0x00000000037A7000-0x00000000037A9000-memory.dmp

Filesize
8KB

Download
memory/2756-152-0x00000000037A4000-0x00000000037A5000-memory.dmp

Filesize
4KB

Download
memory/2756-151-0x00000000072D0000-0x00000000072D1000-memory.dmp

Filesize
4KB

Download
memory/2756-130-0x0000000000000000-mapping.dmp

Download
memory/2756-145-0x00000000037A3000-0x00000000037A4000-memory.dmp

Filesize
4KB

Download
memory/2756-136-0x00000000037A1000-0x00000000037A2000-memory.dmp

Filesize
4KB

Download
memory/2756-135-0x00000000037A0000-0x00000000037A1000-memory.dmp

Filesize
4KB

Download
memory/2756-139-0x00000000038E0000-0x00000000038E1000-memory.dmp

Filesize
4KB

Download
memory/2756-143-0x0000000007050000-0x0000000007051000-memory.dmp

Filesize
4KB

Download
memory/3172-134-0x00000222E4D70000-0x00000222E4D71000-memory.dmp

Filesize
4KB

Download
memory/3172-163-0x0000022280260000-0x0000022280261000-memory.dmp

Filesize
4KB

Download
memory/3172-127-0x00000222FEED0000-0x00000222FEED2000-memory.dmp

Filesize
8KB

Download
memory/3172-122-0x00000222E49E0000-0x00000222E49E1000-memory.dmp

Filesize
4KB

Download
memory/3172-119-0x0000000000000000-mapping.dmp

Download
memory/3940-125-0x0000000000000000-mapping.dmp

Download
memory/4084-160-0x0000000000000000-mapping.dmp

Download
memory/4380-312-0x0000000004281000-0x0000000004282000-memory.dmp

Filesize
4KB

Download
memory/4380-299-0x0000000000000000-mapping.dmp

Download
memory/4380-316-0x0000000004286000-0x0000000004287000-memory.dmp

Filesize
4KB

Download
memory/4380-311-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/4380-315-0x0000000004284000-0x0000000004286000-memory.dmp

Filesize
8KB

Download
memory/4380-313-0x0000000004283000-0x0000000004284000-memory.dmp

Filesize
4KB

Download
memory/4380-309-0x0000000006880000-0x0000000006881000-memory.dmp

Filesize
4KB

Download
memory/4448-169-0x0000000000000000-mapping.dmp

Download
memory/4508-188-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/4508-192-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

Filesize
4KB

Download
memory/4508-181-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download
memory/4508-182-0x0000000005074000-0x0000000005076000-memory.dmp

Filesize
8KB

Download
memory/4508-174-0x0000000000000000-mapping.dmp

Download
memory/4508-183-0x0000000005071000-0x0000000005072000-memory.dmp

Filesize
4KB

Download
memory/4508-184-0x0000000005073000-0x0000000005074000-memory.dmp

Filesize
4KB

Download
memory/4508-195-0x0000000005040000-0x0000000005041000-memory.dmp

Filesize
4KB

Download
memory/4508-185-0x0000000005076000-0x0000000005077000-memory.dmp

Filesize
4KB

Download
memory/4508-180-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/4508-198-0x0000000005090000-0x0000000005091000-memory.dmp

Filesize
4KB

Download
memory/4572-314-0x0000000000000000-mapping.dmp

Download
memory/4572-329-0x0000000004DC1000-0x0000000004DC2000-memory.dmp

Filesize
4KB

Download
memory/4572-330-0x0000000004DC3000-0x0000000004DC4000-memory.dmp

Filesize
4KB

Download
memory/4572-328-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/4572-332-0x0000000004DC6000-0x0000000004DC7000-memory.dmp

Filesize
4KB

Download
memory/4572-331-0x0000000004DC4000-0x0000000004DC6000-memory.dmp

Filesize
8KB

Download
memory/4664-225-0x00000000044B6000-0x00000000044B7000-memory.dmp

Filesize
4KB

Download
memory/4664-224-0x00000000044B4000-0x00000000044B6000-memory.dmp

Filesize
8KB

Download
memory/4664-203-0x0000000000000000-mapping.dmp

Download
memory/4664-219-0x00000000044B1000-0x00000000044B2000-memory.dmp

Filesize
4KB

Download
memory/4664-218-0x00000000044B0000-0x00000000044B1000-memory.dmp

Filesize
4KB

Download
memory/4664-223-0x00000000044B3000-0x00000000044B4000-memory.dmp

Filesize
4KB

Download
memory/4688-452-0x0000000000000000-mapping.dmp

Download
memory/4688-471-0x0000000005970000-0x0000000005FD2000-memory.dmp

Filesize
6.4MB

Download
memory/4796-351-0x00000000056D0000-0x0000000005D32000-memory.dmp

Filesize
6.4MB

Download
memory/4796-385-0x00000000056D0000-0x0000000005D32000-memory.dmp

Filesize
6.4MB

Download
memory/4796-333-0x0000000000000000-mapping.dmp

Download
memory/4796-472-0x00000000056D0000-0x0000000005D32000-memory.dmp

Filesize
6.4MB

Download
memory/4816-431-0x0000000005320000-0x0000000005982000-memory.dmp

Filesize
6.4MB

Download
memory/4816-353-0x0000000005320000-0x0000000005982000-memory.dmp

Filesize
6.4MB

Download
memory/4816-337-0x0000000000000000-mapping.dmp

Download
memory/4856-233-0x0000000000000000-mapping.dmp

Download
memory/4936-261-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/4936-273-0x0000000004E36000-0x0000000004E37000-memory.dmp

Filesize
4KB

Download
memory/4936-240-0x0000000000000000-mapping.dmp

Download
memory/4936-253-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Filesize
4KB

Download
memory/4936-259-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/4936-263-0x0000000007280000-0x0000000007281000-memory.dmp

Filesize
4KB

Download
memory/4936-268-0x0000000004E30000-0x0000000004E31000-memory.dmp

Filesize
4KB

Download
memory/4936-270-0x0000000004E31000-0x0000000004E32000-memory.dmp

Filesize
4KB

Download
memory/4936-272-0x0000000004E34000-0x0000000004E36000-memory.dmp

Filesize
8KB

Download
memory/4936-271-0x0000000004E33000-0x0000000004E34000-memory.dmp

Filesize
4KB

Download
memory/5112-289-0x0000000004A21000-0x0000000004A22000-memory.dmp

Filesize
4KB

Download
memory/5112-274-0x0000000000000000-mapping.dmp

Download
memory/5112-284-0x0000000007050000-0x0000000007051000-memory.dmp

Filesize
4KB

Download
memory/5112-285-0x0000000007100000-0x0000000007101000-memory.dmp

Filesize
4KB

Download
memory/5112-286-0x0000000007000000-0x0000000007001000-memory.dmp

Filesize
4KB

Download
memory/5112-287-0x00000000071A0000-0x00000000071A1000-memory.dmp

Filesize
4KB

Download
memory/5112-295-0x00000000072A0000-0x00000000072A1000-memory.dmp

Filesize
4KB

Download
memory/5112-288-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/5112-291-0x0000000004A24000-0x0000000004A26000-memory.dmp

Filesize
8KB

Download
memory/5112-290-0x0000000004A23000-0x0000000004A24000-memory.dmp

Filesize
4KB

Download
memory/5112-292-0x0000000004A26000-0x0000000004A27000-memory.dmp

Filesize
4KB

Download