Malware Analysis Report

2025-01-18 04:42

Sample ID 230814-pxr6yaea5t
Target expressvpn_windows_12.55.0.27_release.exe
SHA256 8644aab58a88f3490f6a1989b679d2e8a74309b8909d6fb4168470bc7023d0bc
Tags
revengerat persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8644aab58a88f3490f6a1989b679d2e8a74309b8909d6fb4168470bc7023d0bc

Threat Level: Known bad

The file expressvpn_windows_12.55.0.27_release.exe was found to be: Known bad.

Malicious Activity Summary

revengerat persistence stealer trojan

RevengeRAT

RevengeRat Executable

Blocklisted process makes network request

Downloads MZ/PE file

Adds Run key to start application

Enumerates connected drives

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Loads dropped DLL

Executes dropped EXE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of SendNotifyMessage

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Modifies registry class

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-08-14 12:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-14 12:42

Reported

2023-08-14 12:45

Platform

win10v2004-20230703-en

Max time kernel

144s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\expressvpn_windows_12.55.0.27_release.exe"

Signatures

RevengeRAT

trojan revengerat

RevengeRat Executable

stealer
Description Indicator Process Target
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Downloads MZ/PE file

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{1b5f1335-d71c-41d7-b62a-26db1d5378b7} = "\"C:\\ProgramData\\Package Cache\\{1b5f1335-d71c-41d7-b62a-26db1d5378b7}\\ExpressVPN_12.55.0.27.exe\" /burn.runonce" C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{d4cecf3b-b68f-4995-8840-52ea0fab646e} = "\"C:\\ProgramData\\Package Cache\\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\\VC_redist.x64.exe\" /burn.runonce" C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ExpressVPNNotificationService = "\"C:\\Program Files (x86)\\ExpressVPN\\expressvpn-ui\\ExpressVPNNotificationServiceStarter.exe\"" C:\Windows\system32\msiexec.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\mfc140chs.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\msvcp140.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\msvcp140_2.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\msvcp140_atomic_wait.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140rus.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\vcruntime140_1.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140esn.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140fra.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140enu.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140esn.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\msvcp140_codecvt_ids.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\vccorlib140.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140rus.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140jpn.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\msvcp140.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\msvcp140_2.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140enu.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140jpn.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140kor.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140kor.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfcm140.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\vcamp140.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\msvcp140_1.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140cht.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\vccorlib140.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfcm140u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140deu.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140chs.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140cht.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140deu.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\concrt140.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\concrt140.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\vcruntime140.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfcm140.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140fra.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\mfc140ita.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\vcamp140.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\system32\vcomp140.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfcm140u.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\mfc140ita.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\vcruntime140.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\vcruntime140_1.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\msvcp140_1.dll C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\system32\vcomp140.dll C:\Windows\system32\msiexec.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Reflection.Emit.ILGeneration.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\ru\System.Windows.Forms.Primitives.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\pl\UIAutomationClientSideProviders.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.BrowserHelper.runtimeconfig.json C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.SystemService.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Globalization.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.IO.Compression.ZipFile.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Xml.XDocument.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\zh-Hant\System.Windows.Input.Manipulations.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\cs\WindowsFormsIntegration.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\libcrypto-1_1-x64.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\Microsoft.Extensions.Logging.Console.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.ValueTuple.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Core.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\Microsoft.Win32.Registry.AccessControl.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\cs\PresentationCore.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\es\WindowsBase.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.AppService.runtimeconfig.json C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.SystemService.runtimeconfig.json C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\Microsoft.Extensions.Logging.Configuration.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Microsoft.Extensions.Logging.EventLog.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Xml.XmlDocument.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Net.WebClient.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\zh-Hans\PresentationUI.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\zh-Hans\System.Windows.Forms.Design.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\LaunchDarkly.EventSource.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Dynamic.Runtime.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\tr\System.Windows.Input.Manipulations.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\PresentationFramework.Luna.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\System.Windows.Presentation.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\de\System.Windows.Controls.Ribbon.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\DeviceId.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN.Client.Windows.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Security.Principal.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\.version C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Collections.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.IO.Compression.Native.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\es\System.Windows.Controls.Ribbon.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\System.Security.Permissions.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\ReachFramework.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\es\Microsoft.VisualBasic.Forms.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\ru\ReachFramework.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.VpnService.deps.json C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Data.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\zh-Hans\System.Windows.Forms.Primitives.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\System.Drawing.Design.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\splittunnel\install\expressvpndriverinstaller.exe C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Microsoft.Extensions.Primitives.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\Serilog.Settings.Configuration.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\services\System.CodeDom.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Diagnostics.DiagnosticSource.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.IO.FileSystem.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\de\System.Windows.Forms.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\Assets\en-US\70x70Logo.scale-400.png C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\netstandard.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.ComponentModel.Annotations.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Threading.Overlapped.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\Microsoft.NETCore.App.runtimeconfig.json C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\pt-BR\WindowsFormsIntegration.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\zh-Hant\System.Xaml.resources.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.5\PresentationFramework-SystemXmlLinq.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Collections.Immutable.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files (x86)\ExpressVPN\expressvpn-ui\System.Threading.Tasks.Extensions.dll C:\Windows\system32\msiexec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.5\System.Numerics.dll C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI970F.tmp-\Microsoft.Bcl.AsyncInterfaces.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI72C9.tmp-\Sentry.Extensions.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI854A.tmp-\DeviceId.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI92B8.tmp-\System.Numerics.Vectors.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA605.tmp-\DeviceId.Windows.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\e58c821.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIB151.tmp-\Microsoft.IdentityModel.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI970F.tmp-\Microsoft.Extensions.FileSystemGlobbing.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA605.tmp-\System.Security.Principal.Windows.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIB151.tmp-\System.Numerics.Vectors.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Installer\SourceHash{F3B3A61B-DC16-429A-A260-DBAFE66741A9} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIA605.tmp-\Microsoft.Extensions.Http.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI72C9.tmp-\Microsoft.Extensions.Hosting.Abstractions.dll C:\Windows\SysWOW64\rundll32.exe N/A
File created C:\Windows\Installer\e58c845.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI970F.tmp-\System.Buffers.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA066.tmp-\Microsoft.Extensions.Options.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI66D2.tmp-\Microsoft.Extensions.Primitives.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI92B8.tmp-\Microsoft.Extensions.Configuration.UserSecrets.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA066.tmp-\DeviceId.Windows.Wmi.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI854A.tmp-\Google.Protobuf.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Options.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI970F.tmp-\Newtonsoft.Json.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA605.tmp-\System.Numerics.Vectors.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIB151.tmp-\System.Security.AccessControl.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIAE05.tmp-\Grpc.Core.Api.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI72C9.tmp-\ExpressVPN.Utils.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI854A.tmp-\LaunchDarkly.InternalSdk.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI854A.tmp-\System.Runtime.CompilerServices.Unsafe.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIAE05.tmp-\Microsoft.Extensions.Logging.Debug.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI92B8.tmp-\System.Text.Json.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA066.tmp-\Microsoft.Extensions.Configuration.Abstractions.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIAE05.tmp-\Google.Protobuf.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIB151.tmp-\System.Reactive.Interfaces.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIB151.tmp-\Grpc.Core.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI72C9.tmp-\System.Text.Json.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI92B8.tmp-\System.Reactive.Linq.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI970F.tmp-\LaunchDarkly.InternalSdk.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA066.tmp-\Grpc.Core.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI72C9.tmp-\CustomAction.config C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA066.tmp-\Microsoft.Deployment.WindowsInstaller.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA605.tmp-\Microsoft.Extensions.Logging.Console.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIB151.tmp-\System.Management.Automation.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI854A.tmp-\WixSharp.UI.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI92B8.tmp-\System.Diagnostics.DiagnosticSource.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI970F.tmp-\Microsoft.Deployment.WindowsInstaller.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIA066.tmp-\Microsoft.Extensions.Configuration.Binder.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIAE05.tmp-\Microsoft.Extensions.Logging.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIB151.tmp-\ExpressVpn.Client.Setup.Shared.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIB151.tmp-\Microsoft.Bcl.AsyncInterfaces.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI72C9.tmp-\Microsoft.Extensions.Logging.EventLog.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI66D2.tmp-\LaunchDarkly.InternalSdk.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI72C9.tmp-\Microsoft.Extensions.Logging.Abstractions.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI854A.tmp-\ExpressVpn.Utils.Wmi.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI92B8.tmp-\Microsoft.Extensions.Configuration.Json.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSIAE05.tmp-\Microsoft.Extensions.Configuration.Abstractions.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\e58c841.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIAE05.tmp-\System.Text.Encodings.Web.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI854A.tmp-\System.Reactive.Interfaces.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI970F.tmp-\Polly.Contrib.WaitAndRetry.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI66D2.tmp-\Microsoft.Extensions.Configuration.EnvironmentVariables.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI66D2.tmp-\Microsoft.Extensions.DependencyInjection.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI72C9.tmp-\DeviceId.Windows.Wmi.dll C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\Installer\MSI854A.tmp-\DeviceId.Windows.Wmi.dll C:\Windows\SysWOW64\rundll32.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe N/A
N/A N/A C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe N/A
N/A N/A C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe N/A
N/A N/A C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates physical storage devices

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" C:\Windows\SysWOW64\rundll32.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.SystemService.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.VpnService.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23 C:\Windows\system32\msiexec.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B16A3B3F61CDA9242A06BDFA6E76149A\SourceList C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B242EAE62A0A584FBBE2029EEF930BC\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{EAE242B1-0A26-485A-BFEB-0292EE9F03CB}v14.34.31931\\packages\\vcRuntimeAdditional_amd64\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D771A980EA8959141A513D4C65318B57\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{089A177D-98AE-4195-A115-D3C45613B875}v48.23.40665\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{1b5f1335-d71c-41d7-b62a-26db1d5378b7}\Version = "12.55.0.27" C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D743C4FCE4593454882DCE710FF764F6\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\shell\open\command\ = "\"C:\\Program Files (x86)\\ExpressVPN\\expressvpn-ui\\ExpressVPN.exe\" \"%1\"" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.34,bundle\Dependents C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B875EDA4807E94E855F6853A57870C\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B16A3B3F61CDA9242A06BDFA6E76149A\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{0f711ee3-eb88-456d-acb4-c2ee31add211}\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.5 (x64)" C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.34,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.34.31931" C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B16A3B3F61CDA9242A06BDFA6E76149A C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{d4cecf3b-b68f-4995-8840-52ea0fab646e} C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B242EAE62A0A584FBBE2029EEF930BC\SourceList\Media\1 = ";" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D771A980EA8959141A513D4C65318B57\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D771A980EA8959141A513D4C65318B57\SourceList C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D743C4FCE4593454882DCE710FF764F6\SourceList C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{d4cecf3b-b68f-4995-8840-52ea0fab646e} C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14DCC6E369B6DB74E8E17D5B39EC9E67\AuthorizedLUAApp = "0" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B875EDA4807E94E855F6853A57870C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{DE578B32-084A-49E7-8E55-6F58A37578C0}v48.23.40699\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D743C4FCE4593454882DCE710FF764F6\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{CF4C347D-954E-4543-88D2-EC17F07F466F}v14.34.31931\\packages\\vcRuntimeMinimum_amd64\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{CF4C347D-954E-4543-88D2-EC17F07F466F}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.34.31931" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B242EAE62A0A584FBBE2029EEF930BC\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B16A3B3F61CDA9242A06BDFA6E76149A\Clients = 3a0000000000 C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.34,bundle\Version = "14.34.31931.0" C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\expressvpn\shell\open\command C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D771A980EA8959141A513D4C65318B57\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14DCC6E369B6DB74E8E17D5B39EC9E67\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B875EDA4807E94E855F6853A57870C\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.23.40699_x64\Dependents\{0f711ee3-eb88-456d-acb4-c2ee31add211} C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D743C4FCE4593454882DCE710FF764F6\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{E5B9C3E5-889C-4F22-A959-F4B8993D784C} C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D771A980EA8959141A513D4C65318B57\Version = "806854361" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B16A3B3F61CDA9242A06BDFA6E76149A\DeploymentFlags = "3" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B242EAE62A0A584FBBE2029EEF930BC\InstanceType = "0" C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D771A980EA8959141A513D4C65318B57\SourceList\Net C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\expressvpn\shell\open\command C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1B242EAE62A0A584FBBE2029EEF930BC\Assignment = "1" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.23.40699_x64\ = "{DE578B32-084A-49E7-8E55-6F58A37578C0}" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\95E1F2D0BA75B2B74C874D77E76BDC01\14DCC6E369B6DB74E8E17D5B39EC9E67 C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.23.40665_x64\Dependents\{0f711ee3-eb88-456d-acb4-c2ee31add211} C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B16A3B3F61CDA9242A06BDFA6E76149A\ProductName = "Microsoft .NET Host - 6.0.5 (x64)" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B875EDA4807E94E855F6853A57870C\AdvertiseFlags = "388" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\10EA62E1536592372BC00B2945329E52 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XDeviceID C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.Installer.Exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B875EDA4807E94E855F6853A57870C\Language = "1033" C:\Windows\system32\msiexec.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D743C4FCE4593454882DCE710FF764F6\Version = "237141179" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\dotnet_runtime_48.23.40665_x64 C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.23.40665_x64\Dependents C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B16A3B3F61CDA9242A06BDFA6E76149A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{F3B3A61B-DC16-429A-A260-DBAFE66741A9}v48.23.40665\\" C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.23.40699_x64\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.5 (x64)" C:\Windows\system32\msiexec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\23B875EDA4807E94E855F6853A57870C\SourceList\Media C:\Windows\system32\msiexec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.34.31931" C:\Windows\system32\msiexec.exe N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList C:\Windows\system32\msiexec.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: 33 N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\taskmgr.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A
N/A N/A C:\Windows\system32\taskmgr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3516 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\expressvpn_windows_12.55.0.27_release.exe C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe
PID 3516 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\expressvpn_windows_12.55.0.27_release.exe C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe
PID 3516 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\expressvpn_windows_12.55.0.27_release.exe C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe
PID 1692 wrote to memory of 2368 N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe
PID 1692 wrote to memory of 2368 N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe
PID 1692 wrote to memory of 2368 N/A C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe
PID 2368 wrote to memory of 1644 N/A C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe C:\ProgramData\Package Cache\A176F140E942920B777F80DE89E16EA57EE32BE8\VC_redist.x64.exe
PID 2368 wrote to memory of 1644 N/A C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe C:\ProgramData\Package Cache\A176F140E942920B777F80DE89E16EA57EE32BE8\VC_redist.x64.exe
PID 2368 wrote to memory of 1644 N/A C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe C:\ProgramData\Package Cache\A176F140E942920B777F80DE89E16EA57EE32BE8\VC_redist.x64.exe
PID 1644 wrote to memory of 1876 N/A C:\ProgramData\Package Cache\A176F140E942920B777F80DE89E16EA57EE32BE8\VC_redist.x64.exe C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe
PID 1644 wrote to memory of 1876 N/A C:\ProgramData\Package Cache\A176F140E942920B777F80DE89E16EA57EE32BE8\VC_redist.x64.exe C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe
PID 1644 wrote to memory of 1876 N/A C:\ProgramData\Package Cache\A176F140E942920B777F80DE89E16EA57EE32BE8\VC_redist.x64.exe C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe
PID 1876 wrote to memory of 2680 N/A C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe
PID 1876 wrote to memory of 2680 N/A C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe
PID 1876 wrote to memory of 2680 N/A C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe
PID 2680 wrote to memory of 2272 N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
PID 2680 wrote to memory of 2272 N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
PID 2680 wrote to memory of 2272 N/A C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
PID 2272 wrote to memory of 764 N/A C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
PID 2272 wrote to memory of 764 N/A C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
PID 2272 wrote to memory of 764 N/A C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
PID 764 wrote to memory of 2204 N/A C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
PID 764 wrote to memory of 2204 N/A C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
PID 764 wrote to memory of 2204 N/A C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
PID 2368 wrote to memory of 5080 N/A C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe C:\ProgramData\Package Cache\B5B1819CCA753B070181F50411375B80412860A3\windowsdesktop-runtime-6.0.5-win-x64.exe
PID 2368 wrote to memory of 5080 N/A C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe C:\ProgramData\Package Cache\B5B1819CCA753B070181F50411375B80412860A3\windowsdesktop-runtime-6.0.5-win-x64.exe
PID 2368 wrote to memory of 5080 N/A C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe C:\ProgramData\Package Cache\B5B1819CCA753B070181F50411375B80412860A3\windowsdesktop-runtime-6.0.5-win-x64.exe
PID 5080 wrote to memory of 4448 N/A C:\ProgramData\Package Cache\B5B1819CCA753B070181F50411375B80412860A3\windowsdesktop-runtime-6.0.5-win-x64.exe C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe
PID 5080 wrote to memory of 4448 N/A C:\ProgramData\Package Cache\B5B1819CCA753B070181F50411375B80412860A3\windowsdesktop-runtime-6.0.5-win-x64.exe C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe
PID 5080 wrote to memory of 4448 N/A C:\ProgramData\Package Cache\B5B1819CCA753B070181F50411375B80412860A3\windowsdesktop-runtime-6.0.5-win-x64.exe C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe
PID 4448 wrote to memory of 3980 N/A C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe
PID 4448 wrote to memory of 3980 N/A C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe
PID 4448 wrote to memory of 3980 N/A C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe
PID 3676 wrote to memory of 2620 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 2620 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 2620 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 3168 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 3168 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 3168 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 2572 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 2572 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 2572 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 3544 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 3544 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 3544 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 5028 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 5028 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 5028 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 5028 wrote to memory of 4044 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 5028 wrote to memory of 4044 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 5028 wrote to memory of 4044 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 5028 wrote to memory of 2940 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 5028 wrote to memory of 2940 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 5028 wrote to memory of 2940 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 3676 wrote to memory of 4456 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 4456 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 3676 wrote to memory of 4456 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 4456 wrote to memory of 2060 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 4456 wrote to memory of 2060 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 4456 wrote to memory of 2060 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 4456 wrote to memory of 4932 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 4456 wrote to memory of 4932 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 4456 wrote to memory of 4932 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe
PID 4456 wrote to memory of 4868 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\expressvpn_windows_12.55.0.27_release.exe

"C:\Users\Admin\AppData\Local\Temp\expressvpn_windows_12.55.0.27_release.exe"

C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe

"C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\expressvpn_windows_12.55.0.27_release.exe" -burn.filehandle.attached=692 -burn.filehandle.self=696

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe

"C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe" -q -burn.elevated BurnPipe.{1AF47525-BAF5-4C58-BDDB-D4EB81F917DF} {B5BC391F-9F0B-43BA-8BFB-E5EFEB0AA869} 1692

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\taskmgr.exe

"C:\Windows\system32\taskmgr.exe" /4

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\ProgramData\Package Cache\A176F140E942920B777F80DE89E16EA57EE32BE8\VC_redist.x64.exe

"C:\ProgramData\Package Cache\A176F140E942920B777F80DE89E16EA57EE32BE8\VC_redist.x64.exe" /install /quiet /norestart

C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe

"C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\A176F140E942920B777F80DE89E16EA57EE32BE8\VC_redist.x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /install /quiet /norestart

C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe

"C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{113E9E93-FEFE-4815-95DD-A9D6321D76C8} {5BACD1AA-1B54-4529-8A9B-1DB978C667AE} 1876

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe

"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d4cecf3b-b68f-4995-8840-52ea0fab646e} -burn.filehandle.self=1064 -burn.embedded BurnPipe.{9BFF8C01-524B-467E-AA34-C83D99FCB71A} {E3797CC8-8BF9-4A8E-925F-2E360F8DB537} 2680

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe

"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d4cecf3b-b68f-4995-8840-52ea0fab646e} -burn.filehandle.self=1064 -burn.embedded BurnPipe.{9BFF8C01-524B-467E-AA34-C83D99FCB71A} {E3797CC8-8BF9-4A8E-925F-2E360F8DB537} 2680

C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe

"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{898DC1FD-99E7-4019-860B-FF8E058B8D55} {55F41B7C-CF86-4492-A46A-5F41ED460AD5} 764

C:\ProgramData\Package Cache\B5B1819CCA753B070181F50411375B80412860A3\windowsdesktop-runtime-6.0.5-win-x64.exe

"C:\ProgramData\Package Cache\B5B1819CCA753B070181F50411375B80412860A3\windowsdesktop-runtime-6.0.5-win-x64.exe" /install /quiet /norestart -burn.filehandle.self=988 -burn.embedded BurnPipe.{422725B8-5936-4753-8684-D03D1741D5F6} {EE48AF1F-859F-4761-9F98-8E2EBC78A832} 2368

C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe

"C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\B5B1819CCA753B070181F50411375B80412860A3\windowsdesktop-runtime-6.0.5-win-x64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=648 /install /quiet /norestart -burn.filehandle.self=988 -burn.embedded BurnPipe.{422725B8-5936-4753-8684-D03D1741D5F6} {EE48AF1F-859F-4761-9F98-8E2EBC78A832} 2368

C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe

"C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe" -q -burn.elevated BurnPipe.{AFF5F13B-3EE0-4AD8-9A06-376604F4197A} {6BF2BF77-FC86-4171-B0D0-BC8BB9B9B1E9} 4448

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding DBCB181BAACC19D9EB6AD2F5B4E66CD1

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 81BF54ADA562A94C9E9ACBD6D26E51AB

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 7606F3E50C3DD7FA5135D1C8E60130B6

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding C09103AF2551629643767D8C65B66E07

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 57451CA4D2BF2E25F015389999CCC8A2

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI5BC3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240737484 26 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.CloseMainApp

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI66D2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240740046 38 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.SaveDogfoodWasInstalled

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 98038214914858F8C418BB4C16B03C1F E Global\MSI0000

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI72C9.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240743375 42 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.RemoveData

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI854A.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240747859 49 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.SetBrowserHelperPath

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI92B8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240751281 53 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.CreateAccessTokens

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSI970F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240752390 57 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.CreateDefaultPortConfiguration

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIA066.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240754796 61 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.CreateServiceCredentials

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIA605.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240756218 65 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.InitializeProteusId

C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.Installer.Exe

"C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.Installer.Exe"

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIAE05.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240758265 69 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.SetServicesFailureActions

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIB151.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240759109 73 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.AddErrorReportingKeys

C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.SystemService.exe

"C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.SystemService.exe"

C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.VpnService.exe

"C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.VpnService.exe"

C:\Program Files (x86)\ExpressVPN\services\lightway.exe

"C:\Program Files (x86)\ExpressVPN\services\lightway.exe" --version

C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.AppService.exe

"C:\Program Files (x86)\ExpressVPN\services\ExpressVPN.AppService.exe"

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIBBD2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240761828 77 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.RemoveLegacyRegistryData

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIC019.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240762890 81 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.RemoveUserFolderData

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe "C:\Windows\Installer\MSIC6B1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240764578 91 ExpressVpn.Client.Setup.CustomActions!ExpressVpn.Client.Setup.CustomActions.Actions.DeleteBinaries

C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN.exe

"C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN.exe" install

C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPNNotificationService.exe

"C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPNNotificationService.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 126.137.241.8.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 224.104.207.23.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 download.visualstudio.microsoft.com udp
US 93.184.215.201:443 download.visualstudio.microsoft.com tcp
US 8.8.8.8:53 201.215.184.93.in-addr.arpa udp
US 8.8.8.8:53 254.135.241.8.in-addr.arpa udp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 8.8.8.8:53 101.15.18.104.in-addr.arpa udp
US 8.8.8.8:53 101.14.18.104.in-addr.arpa udp
US 8.8.8.8:53 63.141.182.52.in-addr.arpa udp
US 8.8.8.8:53 o137163.ingest.sentry.io udp
US 34.120.195.249:443 o137163.ingest.sentry.io tcp
US 34.120.195.249:443 o137163.ingest.sentry.io tcp
US 8.8.8.8:53 www.msftncsi.com udp
US 2.18.121.80:80 www.msftncsi.com tcp
US 8.8.8.8:53 249.195.120.34.in-addr.arpa udp
US 8.8.8.8:53 80.121.18.2.in-addr.arpa udp
US 34.120.195.249:443 o137163.ingest.sentry.io tcp
US 8.8.8.8:53 clientstream.launchdarkly.com udp
US 15.197.213.252:443 clientstream.launchdarkly.com tcp
US 2.18.121.80:80 www.msftncsi.com tcp
US 8.8.8.8:53 252.213.197.15.in-addr.arpa udp

Files

C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe

MD5 b63f7c2aef96808ed27afbc2d07e7319
SHA1 69f3cdefab1a690b0f4adc8e7bb98ef9fa3300d9
SHA256 c7388b14c3c5cd82252a60ee13844e7bbc81b6b635759475685f210e965fe9b5
SHA512 7d5ab33f55df2cfc9224f4acd67a86cbb15ec83d3ff8e5b04c5de442c75f303f0c64d44ddd01baf97f82905ffd45c773116bd8bd1eafd5bdd7d1aa5a49e5f526

C:\Windows\Temp\{D9B1BFF6-42F1-48B7-A400-76079DDBD7EE}\.cr\expressvpn_windows_12.55.0.27_release.exe

MD5 b63f7c2aef96808ed27afbc2d07e7319
SHA1 69f3cdefab1a690b0f4adc8e7bb98ef9fa3300d9
SHA256 c7388b14c3c5cd82252a60ee13844e7bbc81b6b635759475685f210e965fe9b5
SHA512 7d5ab33f55df2cfc9224f4acd67a86cbb15ec83d3ff8e5b04c5de442c75f303f0c64d44ddd01baf97f82905ffd45c773116bd8bd1eafd5bdd7d1aa5a49e5f526

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\mbahost.dll

MD5 c59832217903ce88793a6c40888e3cae
SHA1 6d9facabf41dcf53281897764d467696780623b8
SHA256 9dfa1bc5d2ab4c652304976978749141b8c312784b05cb577f338a0aa91330db
SHA512 1b1f4cb2e3fa57cb481e28a967b19a6fefa74f3c77a3f3214a6b09e11ceb20ae428d036929f000710b4eb24a2c57d5d7dfe39661d5a1f48ee69a02d83381d1a9

memory/1692-253-0x0000000073DF0000-0x00000000745A0000-memory.dmp

memory/1692-258-0x00000000042E0000-0x00000000042F8000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\BootstrapperCore.dll

MD5 b0d10a2a622a322788780e7a3cbb85f3
SHA1 04d90b16fa7b47a545c1133d5c0ca9e490f54633
SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
SHA512 62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\BootstrapperCore.dll

MD5 b0d10a2a622a322788780e7a3cbb85f3
SHA1 04d90b16fa7b47a545c1133d5c0ca9e490f54633
SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
SHA512 62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

memory/1692-259-0x0000000006670000-0x0000000006680000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\BootstrapperCore.config

MD5 a591cca57a0534087061bb7509208f80
SHA1 b16c4f3651308cbb6a01efc16ee376f6ef5068e0
SHA256 d1f7224eae4295cb89e21d4aaf6aff5f8cfe912090350d8c7a25c3022ee9f75a
SHA512 e416b4cb1b860c99dc5121dcf81bf38b8973d262e810f447ad5dcba33a6e2d485c62a675fc29e259a943174cf7a91d96a74af40787bb2db3336eefb2d41d94ae

memory/1692-260-0x0000000006670000-0x0000000006680000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\WixSharp Setup.exe

MD5 306c76e7c9ebb185392f05089abe813c
SHA1 739fd057d6b90b84b3a7a887990de7e947ddb2d6
SHA256 64c8180576126a5284cac1478cfe5f9301c5da75c8435855a706ebf9a628d368
SHA512 8808069101cfb7c1d894797aec62c43c95358f71186b6472cda86f4e56cd8adb278971e3b22d0b5cd5a778e3af3cc7cc526bfd15f429696dee4f0b3256a6bd87

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\WixSharp Setup.exe

MD5 306c76e7c9ebb185392f05089abe813c
SHA1 739fd057d6b90b84b3a7a887990de7e947ddb2d6
SHA256 64c8180576126a5284cac1478cfe5f9301c5da75c8435855a706ebf9a628d368
SHA512 8808069101cfb7c1d894797aec62c43c95358f71186b6472cda86f4e56cd8adb278971e3b22d0b5cd5a778e3af3cc7cc526bfd15f429696dee4f0b3256a6bd87

memory/1692-267-0x0000000006A10000-0x0000000006B9A000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\ExpressVpn.Client.Setup.Shared.dll

MD5 e2ca3d32206d27ef62097196320b5149
SHA1 7eccaf65b4a4d27a40fae7bf74975cfc03e0f21a
SHA256 91227073892d648c36205f21dcdb8c77c619e8e88776d91721c9bc7aa338e1fa
SHA512 4f5bce725c9534db02c4afa4ed9638220a1ffd779bb4114334fa6eece36f630b5198d1ed168d5ecea7387cf29c7c9e14809ff452f0ae8bcb52ddb5b85dc44930

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\ExpressVpn.Client.Setup.Shared.dll

MD5 e2ca3d32206d27ef62097196320b5149
SHA1 7eccaf65b4a4d27a40fae7bf74975cfc03e0f21a
SHA256 91227073892d648c36205f21dcdb8c77c619e8e88776d91721c9bc7aa338e1fa
SHA512 4f5bce725c9534db02c4afa4ed9638220a1ffd779bb4114334fa6eece36f630b5198d1ed168d5ecea7387cf29c7c9e14809ff452f0ae8bcb52ddb5b85dc44930

memory/1692-271-0x0000000006620000-0x0000000006628000-memory.dmp

memory/1692-275-0x0000000006640000-0x0000000006650000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\Microsoft.Extensions.DependencyInjection.Abstractions.dll

MD5 405bf969e7e50ef47422e54fa33605c8
SHA1 4f3c5c8803212719ee74c60813b9ae08604684b3
SHA256 95a7c66abd60ba45a2020ac3d42702fd9823f7b6db2ceec6a37c9e9b0602fed1
SHA512 d04978227453e3341fbdc6a8730da193f1c5e19a2635e02cb5d6eb6fef7c3ea53cf7df5df16230c12693cdaaccc90add812c5ad0a6ed0749e8de75c03602502a

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\Microsoft.Extensions.DependencyInjection.Abstractions.dll

MD5 405bf969e7e50ef47422e54fa33605c8
SHA1 4f3c5c8803212719ee74c60813b9ae08604684b3
SHA256 95a7c66abd60ba45a2020ac3d42702fd9823f7b6db2ceec6a37c9e9b0602fed1
SHA512 d04978227453e3341fbdc6a8730da193f1c5e19a2635e02cb5d6eb6fef7c3ea53cf7df5df16230c12693cdaaccc90add812c5ad0a6ed0749e8de75c03602502a

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\ExpressVpn.Common.Logging.dll

MD5 0fb9bb66f522eabafe83121c422d66c5
SHA1 492ddeb7dde8283d549222d0966d3e23aa98fd8a
SHA256 0490afdd9b00d111362a104b07c553abfc6f53292336325b79f1649059940fdd
SHA512 ceeb40c2d3a35e404ee93f8e13f7e772353f1736d13efa5c878ec371cf462188a419aa8e6ac2e080b2f58fcea01eb45fd9425f4ba39b419a91965629ef500594

memory/1692-279-0x0000000006980000-0x0000000006998000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\ExpressVpn.Common.Logging.dll

MD5 0fb9bb66f522eabafe83121c422d66c5
SHA1 492ddeb7dde8283d549222d0966d3e23aa98fd8a
SHA256 0490afdd9b00d111362a104b07c553abfc6f53292336325b79f1649059940fdd
SHA512 ceeb40c2d3a35e404ee93f8e13f7e772353f1736d13efa5c878ec371cf462188a419aa8e6ac2e080b2f58fcea01eb45fd9425f4ba39b419a91965629ef500594

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\ExpressVPN.Common.Shared.dll

MD5 dd0a1c213076c88de018a6f3646564be
SHA1 01d5477fae492568f062305fd6ac3d17d9227b7c
SHA256 abc21001f94e57821c6fb89fe5f3f2aeebf2b2b236f41e6f520cdb9e9f9c2c77
SHA512 8c4d6218f9ac2e45faccf49b16361117c36eb54c4bb18a4213f4ffb9ccaf479baefbd0695a6a7e395e814eb5cf3a4cf6bf4bfc535ce2f5e5696d52329d8c72f4

memory/1692-283-0x00000000069A0000-0x00000000069BC000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\ExpressVPN.Common.Shared.dll

MD5 dd0a1c213076c88de018a6f3646564be
SHA1 01d5477fae492568f062305fd6ac3d17d9227b7c
SHA256 abc21001f94e57821c6fb89fe5f3f2aeebf2b2b236f41e6f520cdb9e9f9c2c77
SHA512 8c4d6218f9ac2e45faccf49b16361117c36eb54c4bb18a4213f4ffb9ccaf479baefbd0695a6a7e395e814eb5cf3a4cf6bf4bfc535ce2f5e5696d52329d8c72f4

memory/1692-284-0x00000000069C0000-0x00000000069DA000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\ExpressVPN.Utils.dll

MD5 05b0fc5cb5b7a3aba8d0aa7a7b4afeca
SHA1 8ac8c654a53f00b7e7a5ee6801a122e17ac65a4c
SHA256 5328eedb03cefbb184915d01c1667e7b9c3fac0a91d52532f4fbddfb490de2ea
SHA512 7eb613f4f5f88867df493b184ac5c7f101008addc61bf3d14c2eda5ce46241bc77a41aff5a70ca324bfd06abea1607639b531ac6a32a954abb88d670aea25171

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\ExpressVPN.Utils.dll

MD5 05b0fc5cb5b7a3aba8d0aa7a7b4afeca
SHA1 8ac8c654a53f00b7e7a5ee6801a122e17ac65a4c
SHA256 5328eedb03cefbb184915d01c1667e7b9c3fac0a91d52532f4fbddfb490de2ea
SHA512 7eb613f4f5f88867df493b184ac5c7f101008addc61bf3d14c2eda5ce46241bc77a41aff5a70ca324bfd06abea1607639b531ac6a32a954abb88d670aea25171

memory/1692-288-0x0000000006BA0000-0x0000000006BC0000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\Microsoft.Extensions.DependencyInjection.dll

MD5 f2a9c263e730b94057d26d8e6562e342
SHA1 e36e4c8100585db5c7dbd07ff66f4adad8ccd37f
SHA256 d6de20035b25367a82da6180c45511d9077374c5f96f6cc5fedd2107d61efb9c
SHA512 976fff499e641484a176801ca904221270220d07a1ffe14c03a9b3f32372a264ebe25e704dc63ec18f1bc2a430afa6a098847c327d695a3d19359422a300d4e9

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\Microsoft.Extensions.DependencyInjection.dll

MD5 f2a9c263e730b94057d26d8e6562e342
SHA1 e36e4c8100585db5c7dbd07ff66f4adad8ccd37f
SHA256 d6de20035b25367a82da6180c45511d9077374c5f96f6cc5fedd2107d61efb9c
SHA512 976fff499e641484a176801ca904221270220d07a1ffe14c03a9b3f32372a264ebe25e704dc63ec18f1bc2a430afa6a098847c327d695a3d19359422a300d4e9

memory/1692-292-0x0000000006CC0000-0x0000000006CD8000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\Microsoft.Bcl.AsyncInterfaces.dll

MD5 48efe61d6ca3054309907b532d576d2a
SHA1 f36403aabb16540c93fb35245ec0b4e435628aae
SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
SHA512 778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\Microsoft.Bcl.AsyncInterfaces.dll

MD5 48efe61d6ca3054309907b532d576d2a
SHA1 f36403aabb16540c93fb35245ec0b4e435628aae
SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
SHA512 778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3

memory/1692-296-0x00000000069E0000-0x00000000069EA000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\System.Threading.Tasks.Extensions.dll

MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\System.Threading.Tasks.Extensions.dll

MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

memory/1692-300-0x00000000069F0000-0x00000000069FA000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\Microsoft.Extensions.Logging.Abstractions.dll

MD5 1237591a98cea80b03eaa68dbbcb2176
SHA1 5761dfe8070d1e273c20bf6ce50eb46a8780e065
SHA256 ce8a3129430b92e206d59720adff91ebae0af7c8a808ba81b2ecf9ce680260e1
SHA512 1446308e87aaf15ac1b3f79d8f4620b2172fb4c5f34059df75fae0ab244015cae6ac46faa86a0ab91b71d51bf91476dc407f473016ed0b71526ff6e446bbda07

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\Microsoft.Extensions.Logging.Abstractions.dll

MD5 1237591a98cea80b03eaa68dbbcb2176
SHA1 5761dfe8070d1e273c20bf6ce50eb46a8780e065
SHA256 ce8a3129430b92e206d59720adff91ebae0af7c8a808ba81b2ecf9ce680260e1
SHA512 1446308e87aaf15ac1b3f79d8f4620b2172fb4c5f34059df75fae0ab244015cae6ac46faa86a0ab91b71d51bf91476dc407f473016ed0b71526ff6e446bbda07

memory/1692-304-0x0000000006CF0000-0x0000000006D00000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\Newtonsoft.Json.dll

MD5 715a1fbee4665e99e859eda667fe8034
SHA1 e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512 bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.ba\Newtonsoft.Json.dll

MD5 715a1fbee4665e99e859eda667fe8034
SHA1 e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512 bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

memory/1692-308-0x0000000006F10000-0x0000000006FC2000-memory.dmp

memory/1692-311-0x0000000006670000-0x0000000006680000-memory.dmp

memory/1692-312-0x0000000006ED0000-0x0000000006EF2000-memory.dmp

memory/1692-315-0x0000000006670000-0x0000000006680000-memory.dmp

memory/1692-316-0x00000000077E0000-0x00000000077E8000-memory.dmp

memory/1692-317-0x0000000009D50000-0x0000000009D88000-memory.dmp

memory/1692-318-0x0000000009D10000-0x0000000009D1E000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe

MD5 b63f7c2aef96808ed27afbc2d07e7319
SHA1 69f3cdefab1a690b0f4adc8e7bb98ef9fa3300d9
SHA256 c7388b14c3c5cd82252a60ee13844e7bbc81b6b635759475685f210e965fe9b5
SHA512 7d5ab33f55df2cfc9224f4acd67a86cbb15ec83d3ff8e5b04c5de442c75f303f0c64d44ddd01baf97f82905ffd45c773116bd8bd1eafd5bdd7d1aa5a49e5f526

memory/1692-327-0x0000000009F80000-0x0000000009F88000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe

MD5 b63f7c2aef96808ed27afbc2d07e7319
SHA1 69f3cdefab1a690b0f4adc8e7bb98ef9fa3300d9
SHA256 c7388b14c3c5cd82252a60ee13844e7bbc81b6b635759475685f210e965fe9b5
SHA512 7d5ab33f55df2cfc9224f4acd67a86cbb15ec83d3ff8e5b04c5de442c75f303f0c64d44ddd01baf97f82905ffd45c773116bd8bd1eafd5bdd7d1aa5a49e5f526

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\.be\ExpressVPN_12.55.0.27.exe

MD5 b63f7c2aef96808ed27afbc2d07e7319
SHA1 69f3cdefab1a690b0f4adc8e7bb98ef9fa3300d9
SHA256 c7388b14c3c5cd82252a60ee13844e7bbc81b6b635759475685f210e965fe9b5
SHA512 7d5ab33f55df2cfc9224f4acd67a86cbb15ec83d3ff8e5b04c5de442c75f303f0c64d44ddd01baf97f82905ffd45c773116bd8bd1eafd5bdd7d1aa5a49e5f526

memory/1692-331-0x0000000073DF0000-0x00000000745A0000-memory.dmp

memory/1692-332-0x0000000006670000-0x0000000006680000-memory.dmp

memory/1692-333-0x0000000006670000-0x0000000006680000-memory.dmp

memory/1692-334-0x0000000006670000-0x0000000006680000-memory.dmp

memory/1692-335-0x0000000006670000-0x0000000006680000-memory.dmp

memory/2828-337-0x0000025C35E70000-0x0000025C35E71000-memory.dmp

memory/2828-336-0x0000025C35E70000-0x0000025C35E71000-memory.dmp

memory/2828-338-0x0000025C35E70000-0x0000025C35E71000-memory.dmp

memory/2828-342-0x0000025C35E70000-0x0000025C35E71000-memory.dmp

memory/2828-344-0x0000025C35E70000-0x0000025C35E71000-memory.dmp

memory/2828-343-0x0000025C35E70000-0x0000025C35E71000-memory.dmp

memory/2828-346-0x0000025C35E70000-0x0000025C35E71000-memory.dmp

memory/2828-345-0x0000025C35E70000-0x0000025C35E71000-memory.dmp

memory/2828-348-0x0000025C35E70000-0x0000025C35E71000-memory.dmp

memory/2828-347-0x0000025C35E70000-0x0000025C35E71000-memory.dmp

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\VCRedist64

MD5 703bd677778f2a1ba1eb4338bac3b868
SHA1 a176f140e942920b777f80de89e16ea57ee32be8
SHA256 2257b3fbe3c7559de8b31170155a433faf5b83829e67c589d5674ff086b868b9
SHA512 a66ea382d8bdd31491627fd698242d2eda38b1d9df762c402923ef40bbca6aa2f43f22fa811c5fc894b529f9e77fcdd5ced9cd8af4a19f53845fce3780e8c041

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\Net6DesktopRuntime64

MD5 26d558f92be15a50d59b8261123de56b
SHA1 b5b1819cca753b070181f50411375b80412860a3
SHA256 1b305b1ae89b2391a4411bb2c5edb6b059a7bf7955275c57b43d1f2a94ce3f62
SHA512 5eb1537295cdb513197419c311777229fd43af6cea0ef6134f9990b32b8ac26aa51139f2c0b63d9cdfb6d753dd9db6f243b887ec511f15866157aa9e127b5cea

C:\Windows\Temp\{FA3CDAEE-A3CB-4918-99E0-CD1AB9722CF8}\MainMsi

MD5 3651558f6176021868c2c1d5f3e93fdc
SHA1 adfd4a85ea2d5b3305bb9f14e926c6b9fffef653
SHA256 551c605ea377acd967c5cf8d1d4b61bcbd4c3f3c738e49ad69c3ed1fbbafa4a7
SHA512 bfa8983b6b96833c345c0a969c96433e99fe264c4b2630c6847a723a172351ed7d1fb38f713d4fc4d8f11e705cd212bfb5808b0cb9e903d57b568438a170c5e2

C:\ProgramData\Package Cache\A176F140E942920B777F80DE89E16EA57EE32BE8\VC_redist.x64.exe

MD5 703bd677778f2a1ba1eb4338bac3b868
SHA1 a176f140e942920b777f80de89e16ea57ee32be8
SHA256 2257b3fbe3c7559de8b31170155a433faf5b83829e67c589d5674ff086b868b9
SHA512 a66ea382d8bdd31491627fd698242d2eda38b1d9df762c402923ef40bbca6aa2f43f22fa811c5fc894b529f9e77fcdd5ced9cd8af4a19f53845fce3780e8c041

C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe

MD5 848da6b57cb8acc151a8d64d15ba383d
SHA1 8f4d4a1afa9fd985c67642213b3e7ccf415591da
SHA256 5a61f9775032457db28edd41f98f08c874e759f344ea8475c9ac8abbba68de12
SHA512 ff8b87e7746ecf19a150874dedd6ea4c51c76cfc291c5a80d9e5073a9bbbb2bd6ed7d10425b083578dc8d28d0d905e379fa3f919a60979e5b5c44ebc0ac613e6

C:\Windows\Temp\{A37A3F36-7B3D-4C6F-ADB6-19A99B472F01}\.cr\VC_redist.x64.exe

MD5 848da6b57cb8acc151a8d64d15ba383d
SHA1 8f4d4a1afa9fd985c67642213b3e7ccf415591da
SHA256 5a61f9775032457db28edd41f98f08c874e759f344ea8475c9ac8abbba68de12
SHA512 ff8b87e7746ecf19a150874dedd6ea4c51c76cfc291c5a80d9e5073a9bbbb2bd6ed7d10425b083578dc8d28d0d905e379fa3f919a60979e5b5c44ebc0ac613e6

C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.ba\wixstdba.dll

MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.ba\logo.png

MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe

MD5 848da6b57cb8acc151a8d64d15ba383d
SHA1 8f4d4a1afa9fd985c67642213b3e7ccf415591da
SHA256 5a61f9775032457db28edd41f98f08c874e759f344ea8475c9ac8abbba68de12
SHA512 ff8b87e7746ecf19a150874dedd6ea4c51c76cfc291c5a80d9e5073a9bbbb2bd6ed7d10425b083578dc8d28d0d905e379fa3f919a60979e5b5c44ebc0ac613e6

C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe

MD5 848da6b57cb8acc151a8d64d15ba383d
SHA1 8f4d4a1afa9fd985c67642213b3e7ccf415591da
SHA256 5a61f9775032457db28edd41f98f08c874e759f344ea8475c9ac8abbba68de12
SHA512 ff8b87e7746ecf19a150874dedd6ea4c51c76cfc291c5a80d9e5073a9bbbb2bd6ed7d10425b083578dc8d28d0d905e379fa3f919a60979e5b5c44ebc0ac613e6

C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\.be\VC_redist.x64.exe

MD5 848da6b57cb8acc151a8d64d15ba383d
SHA1 8f4d4a1afa9fd985c67642213b3e7ccf415591da
SHA256 5a61f9775032457db28edd41f98f08c874e759f344ea8475c9ac8abbba68de12
SHA512 ff8b87e7746ecf19a150874dedd6ea4c51c76cfc291c5a80d9e5073a9bbbb2bd6ed7d10425b083578dc8d28d0d905e379fa3f919a60979e5b5c44ebc0ac613e6

C:\ProgramData\Package Cache\{1b5f1335-d71c-41d7-b62a-26db1d5378b7}\state.rsm

MD5 609df9ccab86da94dd43c943c04f414d
SHA1 69c274215e91cc7b19a7a7685831bcce3f896721
SHA256 11ceeb9b1328e2a4bf6f992168c16376b728ad5f4f9c954cde3c81de3b4bddf9
SHA512 02e3d3071db196dcb6360dcc16895237f3b11340fb6bbe20646e6072893e1836bde3943e89f3986c848b5792ffb5d69d993f7a2322157c5d0feef9bea4e3541f

C:\ProgramData\Package Cache\{1b5f1335-d71c-41d7-b62a-26db1d5378b7}\ExpressVPN_12.55.0.27.exe

MD5 b63f7c2aef96808ed27afbc2d07e7319
SHA1 69f3cdefab1a690b0f4adc8e7bb98ef9fa3300d9
SHA256 c7388b14c3c5cd82252a60ee13844e7bbc81b6b635759475685f210e965fe9b5
SHA512 7d5ab33f55df2cfc9224f4acd67a86cbb15ec83d3ff8e5b04c5de442c75f303f0c64d44ddd01baf97f82905ffd45c773116bd8bd1eafd5bdd7d1aa5a49e5f526

C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\vcRuntimeMinimum_x64

MD5 df77fc41aa2f85ca423919e397084137
SHA1 5b87cd2dfb661df49f9557e2fc3b95c7833c9b0b
SHA256 51b6a928f7becbf525cbeff180442b05533f8ea8f8494cc97a491e29bdd4b7c2
SHA512 a36b093011b9534db0881eb72de4638e39be67a9844b14fcd3e40539aafd9aa9ce7b14d3968aedb092ecf9bca9ac0918a65f65632643782edafefa36fc12c3e2

C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\cab5046A8AB272BF37297BB7928664C9503

MD5 45c9c674c0ba87f57168d6ab852e9641
SHA1 73ace24362f14dc58d4099dae6e4e62902e9e950
SHA256 d14f231d1ab0d928e309b067622b5389e0dc6c4f0d3671632066f6586c442c76
SHA512 5bb06ca9c966c9edd30944523a84efd3c13b8eb9f6a5c6cfd961a0c82a1cb193e7b58baf888dede7b740ed42ce76ab20c3e41a684c4dd9d818ff8b0d9e52e684

C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\vcRuntimeAdditional_x64

MD5 c214a9e931bbdd960bb48ac1a2b91945
SHA1 a640c55dd522e01d0be4307a5eee9a40f779a6cc
SHA256 1dbd3e4e71c6678e640c289c1c64bbb12c70f65f52b27191680a9e4141d64b11
SHA512 d25fef3bdd3cd18035892618602e27621e9fb3a913e7972ec7bb624d593ae4b766e718fd2e2c7342c589e9a97beb03d2fedef22e824c6b539b83f199cb967933

C:\Windows\Temp\{83149F0B-F1D6-404F-97CD-7A8ACCD11073}\cab2C04DDC374BD96EB5C8EB8208F2C7C92

MD5 62bc0f466e65d9219281cf75c8f91380
SHA1 0826a1591b81acf0fe30d58e19b0a87df2a49a3e
SHA256 534dd81be6b7a23a745c36eda87e6387c5d146c3a96c84793d0edc7eb85b40f3
SHA512 17713f4228c0c2793c622bbb0a90bd5688d98a6576a695cb956fa233238c4c6e5b0cb43510be4f072613ad575d0b44e7c847f48b785a161cc337a9e6fdca3bb5

C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20230814124440_000_vcRuntimeMinimum_x64.log

MD5 959088cff0bb97f4e35fa26de01a25c5
SHA1 08cff24f78d58cb1ca20ba13a685ab93249cc7da
SHA256 e7056ade2842326150b665207d44ecfaecbb2bcb9383723b0d1409d4d1d9e9ec
SHA512 a7bf799869f134c3f11e8db13d4a72ebfa20933071de52590c1823c98cf35bf6b4bbd09beeca520082e154cfa810bd83e2c248faee5f5e1f052c7b35968663ff

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Windows\Installer\e58c820.msi

MD5 df77fc41aa2f85ca423919e397084137
SHA1 5b87cd2dfb661df49f9557e2fc3b95c7833c9b0b
SHA256 51b6a928f7becbf525cbeff180442b05533f8ea8f8494cc97a491e29bdd4b7c2
SHA512 a36b093011b9534db0881eb72de4638e39be67a9844b14fcd3e40539aafd9aa9ce7b14d3968aedb092ecf9bca9ac0918a65f65632643782edafefa36fc12c3e2

C:\Config.Msi\e58c81f.rbs

MD5 5fd1533001917e5b6a082b9817282716
SHA1 d7a2e61452dce100be59f7558db80dec828516cd
SHA256 3e6a11daa2aad21b306649c0f8383ee85ed667647bf5a3055663f6684d952a1e
SHA512 e1e6cb4e98fa35dcca9a7d6a789fe779591fdff53063b8418352a5384a26dae484720f3ee935768b15dd8571b9beac32c6b7ad4b2e199e758ddb99aee987af54

C:\Config.Msi\e58c813.rbs

MD5 1528eb363e72e71d6fee045ce78b4c49
SHA1 a89162ba5f27df708451a345a4414a042d8f7ff7
SHA256 3b683c348114c52be9ff46529eba10a310a8cbf86961f231ea27285bc461c894
SHA512 e69c2d21e7dcb07d2bcb5e79e0170c75f7960ac56d9754ec07475985d1f70755ac61a99b5eb0b53bdf4a8261b04dbb0b27211af9a23d8674bf55059c73504687

C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20230814124440_001_vcRuntimeAdditional_x64.log

MD5 f0a5da057c3e1258647bbb3c9a09796f
SHA1 33e3b126b36497814a151cb993bbf97877682341
SHA256 4f5b09e252649e75bfce8196dfb4d82b93ce313bbaaad16291f8c93a7a6d5be0
SHA512 67d9b722918e57b5a84026409477c9996245b1e706b8f88b4d0a7f66a9e6b98c68670bb749bd39b4a8c9d4f63ba99e7222ad09fb4255064898e2c3201eaf62e5

C:\Config.Msi\e58c826.rbs

MD5 ea23ab486c094e8f84b5960c80305287
SHA1 cdcab95c86319e7308aafbac87aab7ff33e73771
SHA256 4e02dc5be22ae2abfa53d4f696e08749dc5d8b68d743bbd6a6a6de063916e998
SHA512 7331ebaaa8e24b6b45281f9c03db9376a3ba028b875cc38407eb574b3f7674f2551ae34fbfe9888ad795137ee156a169c3263ca1b34ba9a31f0a513879bd8f40

C:\Config.Msi\e58c835.rbs

MD5 486164541aa773758addb7d60abe0a83
SHA1 670da8f6d759c956f9f8ff5fc270c282637db656
SHA256 3632572ee7747f8e5e1b8dd8afefd958bf4f95a81a5bfa6f4679ec112794f241
SHA512 445b5760fde45e70789a587c4462f48a1e3806cf5cd73c916777e7213a1dfbfecc930ac6c8323377a75b03d36d6c51ccaf29d6a51db23fa44a710d5e6bec8111

C:\Windows\Temp\{B9138DF6-91DE-4E94-959D-D7DACA4E87AC}\.ba\wixstdba.dll

MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

C:\Windows\Temp\{B9138DF6-91DE-4E94-959D-D7DACA4E87AC}\.ba\wixstdba.dll

MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\VC_redist.x64.exe

MD5 848da6b57cb8acc151a8d64d15ba383d
SHA1 8f4d4a1afa9fd985c67642213b3e7ccf415591da
SHA256 5a61f9775032457db28edd41f98f08c874e759f344ea8475c9ac8abbba68de12
SHA512 ff8b87e7746ecf19a150874dedd6ea4c51c76cfc291c5a80d9e5073a9bbbb2bd6ed7d10425b083578dc8d28d0d905e379fa3f919a60979e5b5c44ebc0ac613e6

C:\ProgramData\Package Cache\B5B1819CCA753B070181F50411375B80412860A3\windowsdesktop-runtime-6.0.5-win-x64.exe

MD5 26d558f92be15a50d59b8261123de56b
SHA1 b5b1819cca753b070181f50411375b80412860a3
SHA256 1b305b1ae89b2391a4411bb2c5edb6b059a7bf7955275c57b43d1f2a94ce3f62
SHA512 5eb1537295cdb513197419c311777229fd43af6cea0ef6134f9990b32b8ac26aa51139f2c0b63d9cdfb6d753dd9db6f243b887ec511f15866157aa9e127b5cea

C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe

MD5 987433e22c318ff3bfd596f6b7bb3d0d
SHA1 7b8b48d30370bf1cc8e1c2c68b96622a6051d08e
SHA256 ea4484732f4415318ad0a403f8768129f1d4e6f871602881f3d339bcf7a2fa73
SHA512 8dcf1535cb673983f916d2c6d255f9a0f2ff708d9a356c5d02e0e326ce967353878a1019e686db0cb7e88e6a8cf78e4c73949fb831ca885241e0c5bce3934d46

C:\Windows\Temp\{2EFFE010-810D-4070-A48C-58927667892C}\.cr\windowsdesktop-runtime-6.0.5-win-x64.exe

MD5 987433e22c318ff3bfd596f6b7bb3d0d
SHA1 7b8b48d30370bf1cc8e1c2c68b96622a6051d08e
SHA256 ea4484732f4415318ad0a403f8768129f1d4e6f871602881f3d339bcf7a2fa73
SHA512 8dcf1535cb673983f916d2c6d255f9a0f2ff708d9a356c5d02e0e326ce967353878a1019e686db0cb7e88e6a8cf78e4c73949fb831ca885241e0c5bce3934d46

C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.ba\wixstdba.dll

MD5 4356ee50f0b1a878e270614780ddf095
SHA1 b5c0915f023b2e4ed3e122322abc40c4437909af
SHA256 41a8787fdc9467f563438daba4131191aa1eb588a81beb9a89fe8bd886c16104
SHA512 b9e482efe9189683dabfc9feff8b386d7eba4ecf070f42a1eebee6052cfb181a19497f831f1ea6429cfcce1d4865a5d279b24bd738d702902e9887bb9f0c4691

C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.ba\bg.png

MD5 9eb0320dfbf2bd541e6a55c01ddc9f20
SHA1 eb282a66d29594346531b1ff886d455e1dcd6d99
SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
SHA512 9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe

MD5 987433e22c318ff3bfd596f6b7bb3d0d
SHA1 7b8b48d30370bf1cc8e1c2c68b96622a6051d08e
SHA256 ea4484732f4415318ad0a403f8768129f1d4e6f871602881f3d339bcf7a2fa73
SHA512 8dcf1535cb673983f916d2c6d255f9a0f2ff708d9a356c5d02e0e326ce967353878a1019e686db0cb7e88e6a8cf78e4c73949fb831ca885241e0c5bce3934d46

C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe

MD5 987433e22c318ff3bfd596f6b7bb3d0d
SHA1 7b8b48d30370bf1cc8e1c2c68b96622a6051d08e
SHA256 ea4484732f4415318ad0a403f8768129f1d4e6f871602881f3d339bcf7a2fa73
SHA512 8dcf1535cb673983f916d2c6d255f9a0f2ff708d9a356c5d02e0e326ce967353878a1019e686db0cb7e88e6a8cf78e4c73949fb831ca885241e0c5bce3934d46

C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\.be\windowsdesktop-runtime-6.0.5-win-x64.exe

MD5 987433e22c318ff3bfd596f6b7bb3d0d
SHA1 7b8b48d30370bf1cc8e1c2c68b96622a6051d08e
SHA256 ea4484732f4415318ad0a403f8768129f1d4e6f871602881f3d339bcf7a2fa73
SHA512 8dcf1535cb673983f916d2c6d255f9a0f2ff708d9a356c5d02e0e326ce967353878a1019e686db0cb7e88e6a8cf78e4c73949fb831ca885241e0c5bce3934d46

C:\ProgramData\Package Cache\{d4cecf3b-b68f-4995-8840-52ea0fab646e}\state.rsm

MD5 faf2b0bc3d91d980ac2da3fcc4396ca1
SHA1 4aff5acf859628bbc8364e3ce4a444e5eb00ea6f
SHA256 3955b625e2a0330c9596d635a92d45ff7f7e2e8d31aa56c0078fcb440da59c55
SHA512 2873864f356563826c0ce2eaea6c0f3a041e5d162f502242617312bf4c4a1ff3b73f27a6dcc56a7b6d2cf3ee8bcea2a673eaedfc066ab05656b3cc4f08c4f9f3

C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\dotnet_runtime_6.0.5_win_x64.msi

MD5 abf5dbc0196845d9c906189aa70d07ec
SHA1 4a6879976ca9d64a151e1679d0b08d975883a7b2
SHA256 f8f96b0c0a444a391d1a5c02d217d530905c32895166251d16a1b5903b6815f1
SHA512 035fffdf011e5d30b06ca3b78b37ceb90c1773b08244efc0ca8f7e8b7c4ef83b1b0c5273431e752d0f7dc83a49ccf5fbb733f8235825bf5b8ded32f7b51939e3

C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\dotnet_hostfxr_6.0.5_win_x64.msi

MD5 eef7d4eaa530df3288c03b8e6463aaa3
SHA1 4d94b0073d5afeb1642a2f0da5c178f5765857b3
SHA256 cbdda269bf97e5e990d909fc503149005e4cd70e68d565c0fd4fbed3222d7711
SHA512 2be6dbc2c4d2a8d68653ffd8cb56196178c4ecea2f247a8d6f6cf3061917a43ff814ce48ab2939b475ae0d69df8fe41e0864ebaa282adcfb3e578ca0da10f823

C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\dotnet_host_6.0.5_win_x64.msi

MD5 bdc10a6d27e4df71409c9cd8bc40d48c
SHA1 3cd9327008fc4bc8f76d9f8174bc6a1bbf4d7632
SHA256 ec6d27122faf6585fa4419284a95212102c54bbd7ee02bd56835a496039c70de
SHA512 c60196e4f34efcaa62ac3bb750205b701d7434872fe9eb866a5d80ccab6cef879b35aab0d09c19d25cdbf2a3e19c23a4170a16033ad2fbd008dccc9a6530b1c9

C:\Windows\Temp\{4EBDED39-0F5E-4169-B503-8DB92796F580}\windowsdesktop_runtime_6.0.5_win_x64.msi

MD5 bf16e0cb45daf8f291ecfa351cb0c3c2
SHA1 1491de942eec40921a35f35aa377c2f8f7332c5b
SHA256 0c3b15d1e680e29377a08ec0577d87d222dda47b84c955f4e834497b59041f9c
SHA512 a69a495b265e6e16fbc4a06455a02baabe35c6ad4abf499ca99a4b5cc9dfe2bcf337b6a60d32bfb15eca03b4c08710a095111ec637b2fbef0279c26d9e9e9ae8

C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.5_(x64)_20230814124453_000_dotnet_runtime_6.0.5_win_x64.msi.log

MD5 1558830c3416bfea21208328e6ab6d4a
SHA1 4517d7dd944fbe8d6be8048da7f3b7c0d1eb477e
SHA256 4ac8de1c594abcded27c1f0fbc85a307f48e583ce28041fb0090377a5304e847
SHA512 5613cdb6b1a21c431e24da58d7a96cc5952e25344cb1945f8e3518d46de1f97f76d3bbc4c4af377f63f0162850ced336eb56057b62ec5d930c51911aac38ebd1

C:\Windows\Installer\MSIB45.tmp

MD5 d711da8a6487aea301e05003f327879f
SHA1 548d3779ed3ab7309328f174bfb18d7768d27747
SHA256 3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512 c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

C:\Windows\Installer\MSIB45.tmp

MD5 d711da8a6487aea301e05003f327879f
SHA1 548d3779ed3ab7309328f174bfb18d7768d27747
SHA256 3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512 c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

C:\Windows\Installer\e58c83b.msi

MD5 abf5dbc0196845d9c906189aa70d07ec
SHA1 4a6879976ca9d64a151e1679d0b08d975883a7b2
SHA256 f8f96b0c0a444a391d1a5c02d217d530905c32895166251d16a1b5903b6815f1
SHA512 035fffdf011e5d30b06ca3b78b37ceb90c1773b08244efc0ca8f7e8b7c4ef83b1b0c5273431e752d0f7dc83a49ccf5fbb733f8235825bf5b8ded32f7b51939e3

C:\Config.Msi\e58c83a.rbs

MD5 903cd906505b88ea7b10719ff9bd292c
SHA1 33cd53a9e43e8c3600bbc289cb2cd7fec723bb68
SHA256 3d6524d37e47594642545b61aa9732c0665afc663ee22282d051eca4e39f515c
SHA512 e3f980c57e44eeb827f6f2f0084c77dc18303a4a4e93b024f775e861c0272fc53a255e0127fd0ccf6116c1bfc85280744cee4b60eba8370d9894185a3afd8499

C:\Windows\Installer\MSI2259.tmp

MD5 d711da8a6487aea301e05003f327879f
SHA1 548d3779ed3ab7309328f174bfb18d7768d27747
SHA256 3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512 c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

C:\Windows\Installer\MSI26FE.tmp

MD5 d711da8a6487aea301e05003f327879f
SHA1 548d3779ed3ab7309328f174bfb18d7768d27747
SHA256 3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283
SHA512 c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

C:\Windows\Installer\e58c83c.msi

MD5 eef7d4eaa530df3288c03b8e6463aaa3
SHA1 4d94b0073d5afeb1642a2f0da5c178f5765857b3
SHA256 cbdda269bf97e5e990d909fc503149005e4cd70e68d565c0fd4fbed3222d7711
SHA512 2be6dbc2c4d2a8d68653ffd8cb56196178c4ecea2f247a8d6f6cf3061917a43ff814ce48ab2939b475ae0d69df8fe41e0864ebaa282adcfb3e578ca0da10f823

C:\Config.Msi\e58c83f.rbs

MD5 2ef33714d22e8815dd4b26940a0a818d
SHA1 582ac370a937f27c4f18937cf446af8223c9f3a3
SHA256 ea7a095517b0cd6a4cb9579a3173ab25f8f9fb03f7c051ac8ca47f1cb50edc42
SHA512 ac3c5afe2fea4cf003a3b290515e7a3ce5d9028ec11c5459b4f7db1ba5fc7a4749555c9b1e3d4c3447b98a47993b796c6d5db70aeeb5ce0dd31fe56e5a7ca3f1

C:\Program Files\dotnet\LICENSE.txt

MD5 31c5a77b3c57c8c2e82b9541b00bcd5a
SHA1 153d4bc14e3a2c1485006f1752e797ca8684d06d
SHA256 7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d
SHA512 ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

C:\Program Files\dotnet\ThirdPartyNotices.txt

MD5 f77a4aecfaf4640d801eb6dcdfddc478
SHA1 7424710f255f6205ef559e4d7e281a3b701183bb
SHA256 d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7
SHA512 1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

C:\Config.Msi\e58c844.rbs

MD5 3a5b780b5166dffb0e981ac330cb34c1
SHA1 6ee6d24868e6ea02fc79aff065bfb90216280aa3
SHA256 b3ace4121d94957570a0a2360a6eda681b88025e103ef1a634c07a78fde7a666
SHA512 09e3025bb003be393106a2e46ee03c2148488808229aa44776fa217cc2d295ed2475f35c722e7f5b7e9e60bf5b206208ea4eb2d67b3cd77851d058ce8f861855

C:\Windows\Installer\e58c84a.msi

MD5 bf16e0cb45daf8f291ecfa351cb0c3c2
SHA1 1491de942eec40921a35f35aa377c2f8f7332c5b
SHA256 0c3b15d1e680e29377a08ec0577d87d222dda47b84c955f4e834497b59041f9c
SHA512 a69a495b265e6e16fbc4a06455a02baabe35c6ad4abf499ca99a4b5cc9dfe2bcf337b6a60d32bfb15eca03b4c08710a095111ec637b2fbef0279c26d9e9e9ae8

C:\Config.Msi\e58c849.rbs

MD5 03d11bc4ebe423dabe5ba70f72c751af
SHA1 712676cc3cee8e98d0590ed62122c1a2a4749727
SHA256 a39632669b1ee8ea19f270c2d7ba07f6723aef8cf874c5324a38687f8b83e5d6
SHA512 b882d02b5e583f9548fdbae3f26383c0c59888f19037e0e171bac187cbe14f78a97438bb362a1a1e917439337d53c720d2a67483e0b020f57463bb428b24c68f

C:\Windows\Installer\MSI66D2.tmp-\Newtonsoft.Json.dll

MD5 715a1fbee4665e99e859eda667fe8034
SHA1 e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
SHA512 bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad

memory/2940-1484-0x0000000073DF0000-0x00000000745A0000-memory.dmp

memory/2940-1483-0x0000000004A30000-0x0000000004A5E000-memory.dmp

memory/2940-1487-0x0000000004A80000-0x0000000004A98000-memory.dmp

memory/2940-1489-0x0000000002620000-0x0000000002630000-memory.dmp

memory/2940-1488-0x0000000002620000-0x0000000002630000-memory.dmp

memory/2940-1491-0x0000000004A60000-0x0000000004A68000-memory.dmp

memory/2940-1485-0x0000000002620000-0x0000000002630000-memory.dmp

memory/2940-1493-0x0000000004AC0000-0x0000000004AD8000-memory.dmp

memory/2940-1496-0x0000000004B00000-0x0000000004B1C000-memory.dmp

memory/2940-1498-0x0000000004BB0000-0x0000000004C20000-memory.dmp

memory/2940-1500-0x0000000004B60000-0x0000000004B80000-memory.dmp

memory/2940-1502-0x0000000004B50000-0x0000000004B5A000-memory.dmp

memory/2940-1504-0x0000000004B80000-0x0000000004B8C000-memory.dmp

C:\Windows\Installer\MSI66D2.tmp-\Microsoft.Extensions.DependencyInjection.Abstractions.dll

MD5 405bf969e7e50ef47422e54fa33605c8
SHA1 4f3c5c8803212719ee74c60813b9ae08604684b3
SHA256 95a7c66abd60ba45a2020ac3d42702fd9823f7b6db2ceec6a37c9e9b0602fed1
SHA512 d04978227453e3341fbdc6a8730da193f1c5e19a2635e02cb5d6eb6fef7c3ea53cf7df5df16230c12693cdaaccc90add812c5ad0a6ed0749e8de75c03602502a

C:\Windows\Installer\MSI66D2.tmp-\Microsoft.Extensions.Logging.Abstractions.dll

MD5 1237591a98cea80b03eaa68dbbcb2176
SHA1 5761dfe8070d1e273c20bf6ce50eb46a8780e065
SHA256 ce8a3129430b92e206d59720adff91ebae0af7c8a808ba81b2ecf9ce680260e1
SHA512 1446308e87aaf15ac1b3f79d8f4620b2172fb4c5f34059df75fae0ab244015cae6ac46faa86a0ab91b71d51bf91476dc407f473016ed0b71526ff6e446bbda07

C:\Windows\Installer\MSI66D2.tmp-\System.Threading.Tasks.Extensions.dll

MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

C:\Windows\Installer\MSI66D2.tmp-\Microsoft.Bcl.AsyncInterfaces.dll

MD5 48efe61d6ca3054309907b532d576d2a
SHA1 f36403aabb16540c93fb35245ec0b4e435628aae
SHA256 295af2142d9214f3fd84eafe4778dca119be7e0229f14b6ba8d5269c2f1e2e78
SHA512 778e7c4675d8fde9e083230213d2efa19aa6924fe892ed74fa1ea2ec16743bb14b99b51856e75eaef632d57be7f36dd1bc7ce39a7c2b0435b2f3211bb19836a3

C:\Windows\Installer\MSI66D2.tmp-\Microsoft.Extensions.DependencyInjection.dll

MD5 f2a9c263e730b94057d26d8e6562e342
SHA1 e36e4c8100585db5c7dbd07ff66f4adad8ccd37f
SHA256 d6de20035b25367a82da6180c45511d9077374c5f96f6cc5fedd2107d61efb9c
SHA512 976fff499e641484a176801ca904221270220d07a1ffe14c03a9b3f32372a264ebe25e704dc63ec18f1bc2a430afa6a098847c327d695a3d19359422a300d4e9

memory/2940-1610-0x0000000073DF0000-0x00000000745A0000-memory.dmp

C:\Windows\Installer\MSI72C9.tmp

MD5 fd22b9c9f88759e68069b48bee372444
SHA1 1d73a4a455020098ff260aea775dd072cd75d1a8
SHA256 7c7a41dfb4e389161e378301cc813ac2e2c10f3ce6ebfd9c67a2446d106d7a15
SHA512 59fba4e973687929b101f1cdad777ffe16cab621dcacdb4b2a004d68830412e6993304430e4b7117ee42d520a2e026d0e19ed03508270de780877cfeeb071c20

C:\Windows\Installer\MSI72C9.tmp-\Microsoft.Deployment.WindowsInstaller.dll

MD5 1a5caea6734fdd07caa514c3f3fb75da
SHA1 f070ac0d91bd337d7952abd1ddf19a737b94510c
SHA256 cf06d4ed4a8baf88c82d6c9ae0efc81c469de6da8788ab35f373b350a4b4cdca
SHA512 a22dd3b7cf1c2edcf5b540f3daa482268d8038d468b8f00ca623d1c254affbbc1446e5bd42adc3d8e274be3ba776b0034e179faccd9ac8612ccd75186d1e3bf1

C:\Windows\Installer\MSI72C9.tmp-\CustomAction.config

MD5 c9c40af1656f8531eaa647caceb1e436
SHA1 907837497508de13d5a7e60697fc9d050e327e19
SHA256 1a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8
SHA512 0f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7

C:\Windows\Installer\MSI72C9.tmp-\ExpressVpn.Client.Setup.CustomActions.dll

MD5 03d920190ba3822b3dc32d4006d9a87f
SHA1 4dba2d46a5af7fb21f8e9b0543e94ace9ff19429
SHA256 0683d6a7cb8dd2614ddde42b3a1361499f922c399c2a3642f3c5a9f2d5a5445c
SHA512 6795cfd33366d700e9343f3f59f234e9522c3fb07947cfc28c3e894a8822bd78a36575ec6f10575a6f5453ca25708e4f95a4fa45ef16c4688f4b63f17bd1dc79

C:\Windows\Installer\MSI72C9.tmp-\ExpressVpn.Common.Logging.dll

MD5 900704a24f798bf083d74850ed71853e
SHA1 918406236a746f4a6ec92e1222a0fab74efefb57
SHA256 e366870c224e8867494da86ff94897446f0d5f41da14911235651d2e1f36aba8
SHA512 9624bce2d9be94c748b79459beb2447a65f2da99a016e640eb28325c5bc4ffc31cea076498a42dfbbedd39b89e1321ae6b975596288fb88bed8695df8190801f

C:\Windows\Installer\MSI72C9.tmp-\ExpressVpn.Client.Setup.Shared.dll

MD5 52e6a0ca8ee05559add49d35f886f49b
SHA1 4888a15718e15303bfa5606358c88a3421c4819b
SHA256 b314994c9cc8025cb07728f29529c06b9a38f294701104c8fe7f6e00d7f4f7ee
SHA512 37ae18b67ec65bd5d4b8dbc8a50993b61439d775fe47e78af4fd4c7ca4fb4b6ea8fd66caacbf7f0c97210686c58e7dfde9d1e539bf773ba013ce59cef46dd508

C:\Windows\Installer\MSI72C9.tmp-\ExpressVPN.Common.Shared.dll

MD5 ee342d63e82a68cfdc81d8e44aa05e30
SHA1 6eed17e5382c0b74c138f6843cd0dc27ffc8324f
SHA256 4e56e13a8d2851813b9fb6679a6c9452d6828ed43c7cfab5760df4d1f6dfdb97
SHA512 794bcc03f49016d235aa2c8a2f6145469d8f9028bcc99fec0d5ad8255f2ccb525c0520140934249b06a31346c71d6a51f3034ebdc406da957fb828794f1fe1d2

memory/2060-1709-0x0000000073DF0000-0x00000000745A0000-memory.dmp

C:\Windows\Installer\MSI72C9.tmp-\ExpressVpn.Utils.Wmi.dll

MD5 21c4acf5d8472b092feca231973d5a01
SHA1 b46a14545c2b3a5563547edce55fc8b574ec5540
SHA256 f57daadf9b51276aa7d584d8d52fa50ec25cad212d0c5e03be83b68d7e651571
SHA512 1985d9c53066b16f1151ffe01feb60c71bcc606e7931ec640066e21612d49b4f0b123c267a202cdacc3e66ecbaacf85cc1556fb776a8cccd4504d32efaeff793

C:\Windows\Installer\MSI72C9.tmp-\ExpressVPN.Utils.dll

MD5 892080d10eb9a120bc616826fff9f2ae
SHA1 a695ecca342055c80691301668e09fd13ce112f2
SHA256 6cc4e6979e68baa126af5b6a5bd2b98d3f0ec8131dc0532daec460f1bd25d4b6
SHA512 53ffedc92bbe7174ae0a0afa5d6d1b2c5677d64d84ba144642c27ef1959cf1db23495edb85a5fd3a8d80a51212bb0b247b67adcdd9e98be9a92a064458baccb7

C:\Windows\Installer\MSI72C9.tmp-\WixSharp.dll

MD5 6c3dcc803bdc616fc4041137cfd62b78
SHA1 92d7b3b497c6ddc13bd1bb2ae083118017be0cbd
SHA256 0a82e4db427a80e111016bdf04477556e82773a21f143131563cda3f08c004fe
SHA512 7af9d3af8ebdc7cc9fa7453d998a89d973019df97231d3b1761e215b36e9e34a277d9a97aad99ed175027c5593ba74105368188555cc42342473717065cf01a7

C:\Windows\Installer\MSI72C9.tmp-\ExpressVPN.Client.Installer.dll

MD5 617af2c8f57fd0315d3825736b347626
SHA1 294bf003ae5f528e5a129fca43667a145e752f61
SHA256 61191e86b9696207187cac6651e3ed7d0d2c462c9dd5e29e464f915a74aced6d
SHA512 c5b55cdff5d652b15ecf7c66e6380783513a7d0e96bc07b0f2ea9c60c7181fe3b7e83027e6d7a6fa5f085418742c57bc9070ed9dda72688444fcfe03cf1f24d2

memory/2060-1715-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/2060-1716-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/2060-1720-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/2060-1721-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/2060-1719-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/2060-1824-0x0000000073DF0000-0x00000000745A0000-memory.dmp

C:\Windows\Installer\MSI854A.tmp-\BootstrapperCore.dll

MD5 b0d10a2a622a322788780e7a3cbb85f3
SHA1 04d90b16fa7b47a545c1133d5c0ca9e490f54633
SHA256 f2c2b3ce2df70a3206f3111391ffc7b791b32505fa97aef22c0c2dbf6f3b0426
SHA512 62b0aa09234067e67969c5f785736d92cd7907f1f680a07f6b44a1caf43bfeb2df96f29034016f3345c4580c6c9bc1b04bea932d06e53621da4fcf7b8c0a489f

C:\Windows\Installer\MSI854A.tmp-\Google.Protobuf.dll

MD5 25647dfce0e91490e97f8c6366b2632a
SHA1 8b812d8418143e0e8bc782e6687583dee13710bd
SHA256 da005e408ac85c4fafae30aa79ab7c18ddfa9fb5b23cd7fb2228a88413388c54
SHA512 5c0947cceb867f765ef4e77a73c2e2cea11f80ed83cdd43f3f5816ac2c27403fa74ea6a7edd648061d14d3e480d0f5e8271b754688d8da62e8653ae7581bb910

C:\Windows\Installer\MSI854A.tmp-\Grpc.Core.Api.dll

MD5 33e82bfceee2a76c34edee46091bafc8
SHA1 55c8e27e8efa1e08e87f96424c574ec581335910
SHA256 1e6db7069217797180cf7664e555994a9993db0155c9761be8012860bb82f8a2
SHA512 2818f76c324cfa556c5c9b68cba712c57d12da2f1bf6cf6defd314c0a5dbe4f504e20c04deaf9b69be6a56b01f47fe341ffbca2a431df9a71b28d38c9e1ec6bc

C:\Windows\Installer\MSI854A.tmp-\Grpc.Core.dll

MD5 832a45191b8711adc888d8d45b26f0f8
SHA1 a90d87c10f3e5ed48a80f8e1cf0e883a07830c8d
SHA256 873b7debc4411c2707b48de1454d2ff437d9d56d44ad603c6487a8fb69b4413c
SHA512 94fe9bad110671a1bd965f4847609ed20955f082f96c049b1679634fbc878b189edaf952914137316a3a7ee65996df020ed2c65dcce0b7ba55db853f48132ef4

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Configuration.Abstractions.dll

MD5 baa7644ed2f322d1d2c953220987c4a9
SHA1 3860c3d54413837fd23e9a7081c15d27ab2ed4f0
SHA256 5da295c08aba9257c8f27a39a3d21e0ee82c4e55c098794688305c270b4983b6
SHA512 034cb63f8a8ccf99d2cb182c72e7e5ad67cd23baaca376dff3444c13e9c0bb78e1e5643ed82999130e9398fbd643cd86a875249401a49438b7d7976329d2ac74

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Configuration.CommandLine.dll

MD5 2d3b7a8112a2f148c75ed0820ee2a568
SHA1 e34f939e35591d03b982fe963a6532b427f6c844
SHA256 dabae732fa2b9cdb25bdd6e6f6c804fbd7c512380abcd1e0b8b0e3e32bfed7d9
SHA512 aa270196c7d56679ba47c9c8e0cf0a9e34fafbb15a7ccae2478f7b3410e5c9a4863d48b55fa6d4ca0c91b5563075ecc54969953c32808eec26385c2dc32ffc12

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Configuration.Binder.dll

MD5 b825099a89c81fe4127ee2628596d5d1
SHA1 8e69faa62f82dd042a51a345eea19b959442e985
SHA256 f2f6d158380c32a50bdb827b4d63f97c364f221813641daf74c257034484b507
SHA512 5c8dd2275702daa09bee2a8dac563d1292eef6735cd0a3a250f633afb3ac7823769435c4a29796b0b3522d72312497bac86b5ca71cbba2fbe31ce9cc24557068

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Configuration.dll

MD5 4ae4c4004b28a9c7286ce1b4f2bbf415
SHA1 423c11f0e71b51378f39eb275093aa223c49f848
SHA256 d5f7cd54e4aa3b02bd445bd5b8ff4786cb6463ec976cbfe820fced5e272ec572
SHA512 7bf95813a0c66425dcf3e4d7e0078f72e97a3df9baff9cc525f2292f5cdbbe1cb52fd674089d1be15516770f214b9e7bc937de314eb9042441bf0ef1be28b044

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Configuration.EnvironmentVariables.dll

MD5 f502afa74d2f363e79f3cb93c07b3655
SHA1 5c3aadc3ee63e726f840d9f2c0ac44744dd0fa19
SHA256 5ee4134c25d7c95dadf2d3681949a8b61f72358542edcdb4f2a56fbb469a69ea
SHA512 3630e378e93548762fabfda06a2cb2189e450e16a67583b207c70fbe836e257e0551f829dec10f6ba040e7d95caaccbe3db576266c6e8fc6a3e59e623c6b81d8

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Configuration.UserSecrets.dll

MD5 313cfefa5ac9c9f5d76382a4d738bf3c
SHA1 0bbcd9de636b6c9133a4030f42c0c04aaf51ddf1
SHA256 bc707ac67c82cbf3d7eefdcce641e061227267ddf7a66e08d68be37db5c896ee
SHA512 fc4c2dd62e85a0bb1e62c9702bd9fbec2b93388fc890da3265a13855fabd65b3a64032fa2e1e38bc6be3f1c450b85475843138a4716eefaf404aef8e112904f9

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Configuration.Json.dll

MD5 ae4d8069218e6a793e4cb461e09d4d9e
SHA1 cba0b162d94d80def76020a36c855543e8787ef9
SHA256 dfa8ce0bbd09c898957dc08ca9d3e1db2e87edd5d940c78f6b0becc6243d9d9e
SHA512 6c838cbba6623ec3f9168f79f27ba651073a96cda48cdce244883caba27004ac72f76c77f5012f0b044877fd3d90c1b9425465fc1782f0b5dc37d33c9f124e3e

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Configuration.FileExtensions.dll

MD5 8be2c97bbbe81795e3042602a21965e6
SHA1 cf89501075ac6713c091ca773dad2ba946b7c6ea
SHA256 385ec618612990af5b4d8ec6edffb13fbb5ff5a03e7786033b42ea061ee3976e
SHA512 d89a13ac0e3639acbb26f43739cd7a01ddb07fb03d7e0db5940dd28624d76014ba5e420b45f2d35b1acf0d9b3117a06f41f56109066fc95e9bb438d7516afc04

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.FileProviders.Abstractions.dll

MD5 9b981dcb9329e9043987eb2c24371714
SHA1 c3c45b42a67525cbf8596cf6ef9a56d103bb70f9
SHA256 0706cedcd984a2478f10a9e57bb06e81bae2e0a1271507b26e91fb8f8c3413fe
SHA512 566bf7d258d3306742c3c585d04d19b338a8e1224e29ec7af35770e6827bf597a613775223cf93aa9afcb4ea3da0ca53b99493d9b3c6684da815907c8629b03e

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.FileProviders.Physical.dll

MD5 4e153e7492eae30cd0aa49a3140c1ebe
SHA1 55c123a2f3d1c7e24c4ed5edc54043cd9c37810a
SHA256 6bda4bddedfbb9023a5330dc1fd528e851cf2c869e53f3248e704927cec107cc
SHA512 ba25bbbba4c3e454f4ec064195f5f5e9d0cc4c217b9b4ee538fd31d138224a12c58c0b97c588ea4ea482b2303b0afa04125c30bed102b7c5f2aa645d8e7c03bf

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.FileSystemGlobbing.dll

MD5 f8dc23b883576fb84eccd1b7b56490d3
SHA1 c447b48529380954c878f1d933a10ef1bc402bb6
SHA256 1acb904f6eee86f33b507a7e7cf8f2112d34d1b34daf1532df4d800795d328bc
SHA512 2604147c8a3664e2abeeafe9503cbed07866c763581c7587f59f8472718995c7d17782385826d70ab515a73bf4efc57e91ec5738d09363689305592c38fdb6db

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Hosting.Abstractions.dll

MD5 e4e839b5661a74bb03505202231b56d4
SHA1 31b10ca90a0e492945dbec6cf530389504a7a462
SHA256 601e2c40c930dcd582d421f8f887b62eeadf8a675b77aaa2f98f532d8d97e24b
SHA512 a304a0e18865edd8225ee25ff99ac72843acb9970089e2328cdea8d116a839998d98a58310956b1f8c03caf15e57b91fcf7c2e65672839892fca700fb33f54eb

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Http.dll

MD5 1129546f4edbff1a420986dd25bec97a
SHA1 d01664a6749cc7fdf4d5997abdf72951a45f487c
SHA256 70dab4e760c996a618bd86fd514061f76296c70dc9a9e0da327635ffe6ee88d5
SHA512 a219d16ff2c9b4a5acbb07169b081d4a684355201469591dd75fd5cdee5103e5158c4e11fa32b4f81318aefb6363fa4d2cb61dc39e1b07d01b2d02161fb86d9f

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Hosting.dll

MD5 39d2e1cf94347200c4e2d0f5415dec53
SHA1 0c2e97003acd0c2c0bc516c5b4c892de382239de
SHA256 2c355909c0c6415de0a8a8cc09ee5d6a4538fc19ede1fcff8baab3b1bdf5242b
SHA512 ea6b8deb8e807f87e52d6e06eae62afe595a83d247566a6210155aec9dfa7f9602da789e0985ae87157a56ef26f57bd458bb77f6f3bc34752139f6633f6db712

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Logging.Configuration.dll

MD5 2ca8343993aa0c8d6d619cc2dcab3539
SHA1 d6f6dca968ea17998b7c98585f9d04f2d60f615d
SHA256 92182678c59bff339c919c6d37c94e57904987ac2b1a7f8edbc7a198f0f802f7
SHA512 804337f7a9311d1a7ac364131a095a3c93784ec5c0dc147ee4abedc804170a742f8e3aba4b326c795ca18d43cab76113d9c231f2d0c6023a7a0ea44228984fef

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Logging.Console.dll

MD5 f8536e13697fc017c0c4038a4db6074a
SHA1 1cde865ebae9bd7d000bd29872d692a1d9dba0f0
SHA256 a7e1a4601fa280ad97e4a94069157b057c2d5158388e57058f87cd9f8915337c
SHA512 fd061d0ba67fc6983479bf579d7dba71ac8cf1f3372ee97438b2e455344d56111f6f8ef601e9769d9d9a18789a174a96d7a47f04ca719b189bb56b42922ec061

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Logging.Debug.dll

MD5 523731ef0c75f3cf36d17e0c0f7c6ee7
SHA1 50e24c55d1399ea6550652e3de8d80de7d1d02f7
SHA256 ce241f96331ca11eacac64c683e11fe659e5ac157eaa224c9fe742d20b1ce983
SHA512 727539dbcacb28b23a21e037d439bc8c506ac2aaccf1d1a7a76f6d91c6739f0c317a3e1ee2e6bff3f3f1eee172daacbce21fd35b4bff3ad4459de405167cfa7e

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Logging.dll

MD5 73eab96c0898a78a61d89782ef6fab83
SHA1 07541eed457b5977890c13622d4fc4cabebc67fb
SHA256 c4b2b98c21b24b88640bc0be5dcd335d82df129dcaa0dcc778d91a759a037524
SHA512 90e8b699f451667d18762cbeb0f050f5462e97186b2b495b5de737ae565a7e1667c0ae5d89442ad93c08f2b5db5459b7febb63b1667466e13908f24cf1e3c075

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Logging.EventLog.dll

MD5 fc9949be824804ec4875dfcb0eda5057
SHA1 85a10da292711b68ed97d493bb04cf6552b7d998
SHA256 97f6d53966086a22da7cff8c6bfa38dd5469f8faed34cbaeb0922e5ba576421f
SHA512 13cb04ea01094fcb904640d7bcb552bc8f523581932a5dd2a5660e362e92e21dc73e285663ab91ee2128b0cdb4b067f3e2e3a8cc798df333fdc5fe5cacc29a91

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Logging.EventSource.dll

MD5 3a6dda95bb1aa1e413008d68b957bca2
SHA1 ac364ffc2cb711ffd43131ac9c6e86f1c408de65
SHA256 221c6c8fbdcf28e01aebd74ac8d39cdf230d9eb51138102b443b8c8cc1c0d74b
SHA512 2e4960640d3aaf7c4c9318f29fedfe3ca3c004681acbb69581c6a2b5803d57ea453a1db153a8c22482c2b490e58d721ebf32190abb4296df6f62466ee10272fd

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Options.dll

MD5 3ddea0033ead23660b51921146dda017
SHA1 5708c44aa5326da0a69072a9b0e48715112a4bdd
SHA256 c4673c6000602e76844bad63feecbe42d88fc72639b1fd64d2acde48955be970
SHA512 d57e25a2412f2685770e3fd1d6650ee433ed28d337221941841eb9589dbf3868a27efb0d488f960f75785e60357cd2914b0eece1da62aa9ffe77219340c03576

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Options.ConfigurationExtensions.dll

MD5 40a801619f536846ff777beadcd62f27
SHA1 5a3c722df02ffc81d813224d98af375ab7b09cf9
SHA256 9d38b26507120c8cbefacbf6d2ddb5e89a53db475efefcfde221685b8eed0803
SHA512 d2ad123ebe1e3c41a5ce58e54b3c7847236e99ca3d30ba92f75df432fd94276d185e982fc6d72c2cd2d4d22eff5094b92ddea7b9d5615df14c2d1aab90936a01

C:\Windows\Installer\MSI854A.tmp-\Microsoft.Extensions.Primitives.dll

MD5 d833ddcb52e5c6d6da71bae25395a911
SHA1 17ce025ad7a0175c467f5a7108ca81a813e4ac21
SHA256 76152e774b2bd9c5a0d301e92e253d8bf55fa90e191d0155dfd86b2b84766ae8
SHA512 fd963a9fa5bdd10a1c54ce8fcba862b59786280ca5d668fa041b30b80d7fa2b84230d33b1c0541423534c764e7432213039d5f586d0427d542c0faf703081a79

C:\Windows\Installer\MSI854A.tmp-\Microsoft.IdentityModel.Logging.dll

MD5 a588b379588e876fd4332007a7b0b959
SHA1 5c4df46b6de81d96062eab5b9ef1d65132a03960
SHA256 e53c9d284acb1ea6d3e9f107e0f438d3254d4f773ea24b9258f6a7bec77a3652
SHA512 12b0f872a74d670ce0bd24b65817b75e99d0f79569ff18b50ae0f472410d70d58e74fa8f897dbaffa2f450bb461831c080f0530aa59817aef3272d48b7746604

C:\Windows\Installer\MSI854A.tmp-\Microsoft.IdentityModel.JsonWebTokens.dll

MD5 7bd1e91ad4273dbcde6e373597fd83af
SHA1 b0b3b60aa2a7423f82464f69215c2e051cc7e940
SHA256 53164e2aeaff7159ac8ab382c932c9ff744478ac4012bd5652f70c7ae4829fb9
SHA512 0a4b04ef1eb85f74f19490c420a4434632e44c110abe427bf30d301f0bc633048bc3b52c480e14bccbe51afbd33413b84d948ba04d6af4261a8b390cb414d734

C:\Windows\Installer\MSI854A.tmp-\Microsoft.IdentityModel.Abstractions.dll

MD5 4a33568984c97ab8db98b56f55b88b93
SHA1 368abcd3d56dbeaf66392575914f9bbd2e7cc85d
SHA256 2a621fb5b3c3dc83c989667527570c62a4f6e65bbd239753410ea0857777e1ac
SHA512 eea1e09319bd92d1e079b32779b9635d8d698a8785d05fcd2dfd1ec9bdba5cb866f4c9e4f4fd03a46dff68daf2ef872ac537f4b6fbee14059bbb7756b048ebef

C:\Windows\Installer\MSI854A.tmp-\Microsoft.IdentityModel.Tokens.dll

MD5 6c80eaf13c1d1f82ebec05b199546940
SHA1 62d69b4d752e5d689bb8f9e413c911e796b0aa01
SHA256 dc7a38cbaa808bc20fd529d174cbfd83b66fc814cbb63704e2d9f350e7fe0bf5
SHA512 78b512313740ff15f12d4cfde7c3c06484db47661e26d959983acf5b8ef16ab347a8d5af0be9ccd6602823d3f6ec6d8b38ec545b2c17c7f9b3aba82814375c69

C:\Windows\Installer\MSI854A.tmp-\System.Buffers.dll

MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741

C:\Windows\Installer\MSI854A.tmp-\System.Collections.Immutable.dll

MD5 c598080fa777d6e63dfd0370e97ec8f3
SHA1 9d1236dcfb3caa07278a6d4ec751798d67d73cc2
SHA256 646d3b52a4898078f46534727bdb06ff23b72523441458b9f49ecc315bf3ef5c
SHA512 8a5b4afb4363732008c97d53f13ee430401e4a17677af37123da035f15f9e9409a2aeb74ae238379291fd5de07c3cd4e3de2778da5edf83a42649fa5b281cb32

C:\Windows\Installer\MSI854A.tmp-\System.IdentityModel.Tokens.Jwt.dll

MD5 f82c0055ab6c947dc914e6590ebecc06
SHA1 a13340f024502a3a22cc29598ffcaa5c1b167be4
SHA256 552ed472029e12788877041719164261eccceaded535228933191449425e3870
SHA512 49360174e430fc35edcd4cc437ef93d4626896b1e652f5680b720424e5220a61a0d3a1cf1595eeaf19d58be5549860c4d9c9dced66414554a48bec1238e3c4fa

C:\Windows\Installer\MSI854A.tmp-\System.Diagnostics.DiagnosticSource.dll

MD5 ccb6a65fa77074cdb0cb00478a89aecc
SHA1 be6e62302419bfcd9fd9842a9084e64367580970
SHA256 599a79d25958eae655ddae7337477d16ebc4f013b6896bbd60719c85b37db88c
SHA512 0495c13ced63266fe1adbabc0e2c86e7d6ce1b1dc3065f42a40607239ae88c92c39eba07a02dc0c68e200883b65a8541fd7b5c3dea58cb4c6d494dee0946d605

C:\Windows\Installer\MSI854A.tmp-\System.Numerics.Vectors.dll

MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8

C:\Windows\Installer\MSI854A.tmp-\System.Reactive.Core.dll

MD5 f20967beae947a5d54156b5cb40d0c04
SHA1 c5ea57f70835e22cbaf08ac5262716de3de16f2b
SHA256 ac464ea84539c60cbdb498dd787f6fb90b2f11067a5acc9e1ed4f8f62cb7bc7a
SHA512 7f1fd97ac58bfe5194e348a141595bb261870bed0cdab0e491aec40da7a930d2d821457aa2e44c80da276bbce98dd3a08e344de3539037367977815055a79435

C:\Windows\Installer\MSI854A.tmp-\System.Reactive.Interfaces.dll

MD5 0a471405a43ace8273b6e266f819901f
SHA1 bb7c4d3930358fa574136248cc1da6c9bcf5f192
SHA256 c86b4625d3a35b6f600d8f0d129b82eb73928e5d4f9df1a028e527aac86ee4e4
SHA512 27da5c7d98cac39525b845f40f128cbbdec6a693c1f20be689a1bc2ec0a2fa33a1a82605dad06e410371cf069304663bd6bf1c4a5864d99921e0584243b33997

C:\Windows\Installer\MSI854A.tmp-\System.Reactive.Linq.dll

MD5 317dce13b2316abee548a2b013f26471
SHA1 3123573b2291a0f01badb10b149f741bcb9eb0f7
SHA256 21fad2983b4b2f95049e975c9f26a77bfe9281d8ed18e380c9017fc82137a1d9
SHA512 3444f813632f5f397b5c27e0314479a404b7ade058a5e6c540331fa4fd5fa798ba7352b1bf58d6f977e5e61912ed9620a1ec1350901d0b00fad2ace3eaeb6163

C:\Windows\Installer\MSI854A.tmp-\System.Reflection.Metadata.dll

MD5 c4ea65bd802f1ccd3ea2ad1841fd85c2
SHA1 2364d6dd5dd3b566e06e6b1dc960533d2b3017b7
SHA256 46451e1168dd11d450aa9b6119f17cec9a70928a40ac3c752abf61ce809cba6f
SHA512 fc4c18ea6a6f38d8c4b4f2e02d3d077cc729b531ca08cf9602c65e22aadc0be770e441660cc980cbfed3b27bd783e65f793838532673e2845276390b4b22d730

C:\Windows\Installer\MSI854A.tmp-\System.Text.Encodings.Web.dll

MD5 e8cdacfd2ef2f4b3d1a8e6d59b6e3027
SHA1 9a85d938d8430a73255a65ea002a7709c81a4cf3
SHA256 edf13ebf2d45152e26a16b947cd953aeb7a42602fa48e53fd7673934e5acea30
SHA512 ee1005270305b614236d68e427263b4b4528ad3842057670fad061867286815577ec7d3ed8176e6683d723f9f592abcbf28d24935ce8a34571ab7f1720e2ffc5

C:\Windows\Installer\MSI854A.tmp-\System.Text.Json.dll

MD5 38470ca21414a8827c24d8fe0438e84b
SHA1 1c394a150c5693c69f85403f201caa501594b7ab
SHA256 2c7435257690ac95dc03b45a236005124097f08519adf3134b1d1ece4190e64c
SHA512 079f7320cc2f3b97a5733725d3b13dff17b595465159daabca5a166d39777100e5a2d9af2a75989dfabdb2f29eac0710e16c3bb2660621344b7a63c5dbb87ef8

C:\Windows\Installer\MSI854A.tmp-\System.ValueTuple.dll

MD5 23ee4302e85013a1eb4324c414d561d5
SHA1 d1664731719e85aad7a2273685d77feb0204ec98
SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32

memory/4932-2170-0x0000000073DF0000-0x00000000745A0000-memory.dmp

memory/4932-2172-0x0000000002640000-0x0000000002650000-memory.dmp

memory/4932-2173-0x0000000002640000-0x0000000002650000-memory.dmp

memory/4932-2175-0x0000000002640000-0x0000000002650000-memory.dmp

memory/4932-2186-0x0000000004D70000-0x0000000004DE6000-memory.dmp

memory/4932-2187-0x0000000004E00000-0x0000000004E1E000-memory.dmp

memory/4932-2292-0x0000000073DF0000-0x00000000745A0000-memory.dmp

C:\Program Files (x86)\ExpressVPN\expressvpn-ui\ExpressVPN.exe

MD5 f5d8469bd89262b9d97d73528f23b2d7
SHA1 73295f57edf95daa10f76f7328b54cabe542e673
SHA256 3bfc2015f604ac3b1b36ef6baa47dd70e65daf97b38ac804dd7859b368043030
SHA512 06bc31c5fa17bc7adee0a842f22194d0adc93f6e302ba2a08cbd86ddca8be90f73bae17ea1e95d5436d07e31957248d8c649722352a42c7901a298727ddb3077

C:\Windows\Installer\MSI92B8.tmp-\System.IO.FileSystem.AccessControl.dll

MD5 3409c581f0c5083f0c2a93a7a5ac9790
SHA1 18ea7bd41d31247148abf184527c9368a26f39e7
SHA256 e6026501ad4056ff2f1655b0afdfe8923bc6e8fbad67e1e9ef56e3002f49fbb9
SHA512 ae877c6fddad0e4133274e6372d783eaa4dd6bdcbbf40ab66302fb89bd2f76b215130001186b5c9a135abd16336c5bfd4d414177704d7d359539da91918e82ed

C:\Windows\Installer\MSI92B8.tmp-\System.Memory.dll

MD5 6fb95a357a3f7e88ade5c1629e2801f8
SHA1 19bf79600b716523b5317b9a7b68760ae5d55741
SHA256 8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
SHA512 293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0

C:\Windows\Installer\MSI92B8.tmp-\System.Runtime.CompilerServices.Unsafe.dll

MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396

C:\Windows\Installer\MSI92B8.tmp-\System.Security.AccessControl.dll

MD5 996aab294e1d369b148d732e5ec0dfdc
SHA1 28465fd34680a082506f160107f350b46140a1aa
SHA256 1fda491eebdb19ea0a83cf6c16ab5dd004a1bfdfc845ede017ebe0945beb927f
SHA512 5e6b172d2de5928915b38ec80c7b76f42430aac959f04aa3521c63495b6f3c4f82df139c275e9fc5024b1a0a4f307daade6130b6028779f98f456282ae8b61cd

C:\Windows\Installer\MSI92B8.tmp-\System.Security.Principal.Windows.dll

MD5 be2962225b441cc23575456f32a9cf6a
SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6

memory/4868-2405-0x0000000073DF0000-0x00000000745A0000-memory.dmp

memory/4868-2408-0x0000000002A90000-0x0000000002AA0000-memory.dmp

memory/4868-2411-0x0000000002A90000-0x0000000002AA0000-memory.dmp

memory/4868-2514-0x0000000002A90000-0x0000000002AA0000-memory.dmp

memory/4868-2517-0x0000000002A90000-0x0000000002AA0000-memory.dmp

memory/4868-2515-0x0000000002A90000-0x0000000002AA0000-memory.dmp

memory/4868-2518-0x0000000073DF0000-0x00000000745A0000-memory.dmp

C:\Windows\Installer\MSI970F.tmp-\ExpressVpn.Client.Setup.CustomActions.pdb

MD5 00096f7c8e737a6207fe6b3ffb9316e8
SHA1 b60d4537ceb99baac24c08867893ca05a40c6ea1
SHA256 6f3116718dde1f784037740231e72aaa2b53b6a8cadf7284dece924e1faccaab
SHA512 29a69511864bbda009a2d2b9f1e68c219723e4227d302bd40107a201550132017524a23f443e9dbaa05e271a94ab91bef6dfb84f5dd7e89012ce0b9c407678b4

C:\Windows\Installer\MSI970F.tmp-\DeviceId.Windows.Wmi.dll

MD5 6b8de9e5016f4e51b7f5556ae0130af4
SHA1 799f150da2f5c484e29c7384f9637870e43aad79
SHA256 fb445433c07fecc6ad26033fa89d45430ab7726db5beb465feb197440dbc0e35
SHA512 89d6b9160bfb4e5e73f965b4cb5f6da22b4477bdc96dfb033b0be67a902848c0f1fecda827949ce0f66cb02397f534e5586084f0900e928907ecdddef9479a5c

C:\Windows\Installer\MSI970F.tmp-\DeviceId.Windows.dll

MD5 31df7c0f440942989a0d57d7cadcc7f8
SHA1 451641929eee0b222c62d4310847a8fa24c34c96
SHA256 258ed9e94210dc983f1b4b6b2dbc651c36e4806877233ee82a63f4059d0517c1
SHA512 6d862009c90db51f1b852226eebd8c71878fadc21f2904b0de29b6aa79e49d856dcf0423bdcb7e5f31f5cb8f83dac7aec13f52e6b1c7ad566cd69d7da5411f36

C:\Windows\Installer\MSI970F.tmp-\DeviceId.dll

MD5 e2ba8ce4b851abca137f65aa9ccc6ea0
SHA1 da5bd6c757c51beab86803ea071b24cae6ef5318
SHA256 1ed1250f4245e1a582d395ecda9bff3dcf3d28fa54d79e74d35dfc40d8f7d01e
SHA512 b8b4d58fc78da6c22a07e5c26173b4944704e2f711461f4fc45418bd067a3b491eb52714d33f8e041aaeda6ab4ea0db1a21c855175898298515b874d32dae8d3

C:\Windows\Installer\MSI970F.tmp-\Kape.Braze.dll

MD5 9fb574eb92af344a849fc2cb4a80530f
SHA1 9eb0c493e4eb8ac0fc72970d00515340170374a0
SHA256 390282dbe1d5d7d053fed0df1ba434582554e4f5f5c64629d186f7c00d88ae6f
SHA512 5d25699cfae84f6d546e3b3bbea9569128f507c76502149c9b5a75924d6ee5252bee8112f21e42734826b8eb9efd61e7049c714a5fcae711893b61fe0ec0d586

C:\Windows\Installer\MSI970F.tmp-\LaunchDarkly.ClientSdk.dll

MD5 105cf915b3150eac9d79288fdd964760
SHA1 a22104651ac3b0ade82b2b62ca47892f369361bf
SHA256 e277ec049e104842d499529996eb7b804c5db1376453d47e1e276bc54e0b8cc2
SHA512 d1f552476c24a3363e8c994ac202d2d3aa3c6490a3a477617773d13ceb22fb75e7284b7137866d352270588dc0092ead0dcd8ea61e336eb80d534a4a4d466121

C:\Windows\Installer\MSI970F.tmp-\LaunchDarkly.CommonSdk.dll

MD5 82f45ad67c0e60d6c696fc92241322bb
SHA1 a8146019d19a665a1272845aba288a257da708bd
SHA256 8b038e0b6f40f9900932d965f69b651dc7d64e729a5b0423d816c345e97b56eb
SHA512 e4752c8a319d684f8b3e7866cb9ddba926cf60881fb777b7c52d4aa5df6bf57c620e2e0330c2d6794663bd50385e64dce05202f2e0ed6ea3f7425d25e9922db7

C:\Windows\Installer\MSI970F.tmp-\LaunchDarkly.Logging.dll

MD5 e253422ce4ac1d0a52b265b0cdce9c2d
SHA1 a0f1eba97e0542ee365a736fa05aa12ada3c4ab6
SHA256 edecc0f29377e9527823b472c6fae9cb0d998035ca93c08b1e8ab64adb0e8c05
SHA512 ef0f0c9b5afc8ad039653d9edf1edcfccc5093c3ad99c976a6770a3ae61895e41c8b9b09ce7122fa536de154091ab0c6a0d56deee27911dc63fc5ce362c96ccc

C:\Windows\Installer\MSI970F.tmp-\LaunchDarkly.JsonStream.dll

MD5 3e1eb4509f8ef686e98b31b4b13a3323
SHA1 a63e9dd6945245e940a6d6a1d19e9bc013b6da80
SHA256 9a24cae456f1b47049895767f1e56dcfd4f73d8e38300527422a6f5b01292acf
SHA512 a6dac2ee3e5ae678f23d45683823d46a0a874141a1b723919e9798cf1ade318b065ea74e6904d154108a3f8cb1b619280ba79cc476aefad55d89cd191d84bd47

C:\Windows\Installer\MSI970F.tmp-\LaunchDarkly.InternalSdk.dll

MD5 faba806124d4ec72859a830f2e4b4faf
SHA1 c8013402680e1d95a01c5ed58512d80527ccb212
SHA256 eae38132da2108217be77dea0f736b63f12bf5f5f3453b4466f3e87cabdd4ea4
SHA512 40ab40d0a3f29b8cbba178d60f80208f1f817adbb661d539a7e0b12933da7a54287513cf39fa4ec08c2e576a6398e773147e2ff8888513a2a9218a9f1b63321c

C:\Windows\Installer\MSI970F.tmp-\LaunchDarkly.EventSource.dll

MD5 6cb1a37a829e88fb45271fe24f084cbe
SHA1 c02660751838a9c20cc61d084a9bf59ddc465499
SHA256 b82a52a25349da5811dbc8e08fb33aa1afc5e0c7cb25300d67b28df355e9aab7
SHA512 607608062053e30112d7c7c7cde29c92dc976260455e40bc6e66346c42acf70e077b1e5789feb31e772ee52df9c547458c500d6be592944ea38d7531187fd7ce

C:\Windows\Installer\MSI970F.tmp-\log4net.dll

MD5 2b7439a34d462a7ea2351a8f9e9f24ab
SHA1 7003aabfc4e068920f5e42ff6fab7c93f0c64301
SHA256 ac4e610da23819631fbade66b0107e969fbdb9ace02d1f57a6238aa3e1ecafa0
SHA512 ea6c35e015f47b2726f05a421cb3971245ec6b82f565e85be7317676187ba55d2becc973762fc73eec3b92ede1bb8704d74ae79fa094a7020baa2447259d4ded

C:\Windows\Installer\MSI970F.tmp-\ManagedWifi.dll

MD5 26cffce5c0c23e56163bb7bf364179ed
SHA1 e8aadf70075d08738a83fe44fb7abe1bde3921fd
SHA256 8230d3431ff724e9d4c52dd1b2ac64aff945071088aeedeb47a81eacfd66eea6
SHA512 38aa464328f33c506b3ef43da06c2b0b5dba4b823e96bbdf1daeb69082fb7e735653c7422576fcb7139cd9482f80c3865dbc4a1feca1d2288bf04c98916c5b15

C:\Windows\Installer\MSI970F.tmp-\MissingLinq.Linq2Management.dll

MD5 d9234f27c88f2c2e1337442f75110e60
SHA1 ff797534ccd06e95a504ae5c974e3699b074511e
SHA256 ea3e76179efbe2cc85ee498acb2cac88ce7535d3c3fa7c8202ea6502c44bc628
SHA512 7c7a403efce0bcafb8529c8144b1908d7c07b7c9d963f0c4489d39dfd208fb968a601debaf991fb2e8c65a6374ca5d99bf70ce4d8d3a15b55d310d90093ec9b4

C:\Windows\Installer\MSI970F.tmp-\Polly.Contrib.WaitAndRetry.dll

MD5 d5e62b0b549534de633d7fe7c3b9e34c
SHA1 0848c14f7324b533e704b1ca004af33f6102dc28
SHA256 f6a0d6c7a1f679e8282236662450eb6df04bab68e6c807e0afb18f65be4f0d28
SHA512 933efb45a6721f8e1a6fc33ee3c45a92c2de1e56e33e49e53ffc2562ae51521d05cb620b587e1545113c865a4eef1c4be73b08d03171034779d65172adf27641

C:\Windows\Installer\MSI970F.tmp-\NLog.dll

MD5 2ad4b728eb088cb528d63ea03f73f8ec
SHA1 1951d820f29f7b96c2511c2f3a3f5a312aba66ce
SHA256 09e07a6d2cf754e2409c98ed95e19ed1029bb3a04b02b04473af7a947ddc0fca
SHA512 99e938c392d238f0e6d586c585b2eb0278a0bdcef1c3890fb3092615c95176cbbe580b4f75d847a109e71a9ab89526aba238f1b0c01ab5bdb65d2edf18b2424a

C:\Windows\Installer\MSI970F.tmp-\Polly.dll

MD5 849d66e555f24c7cb254fa83267d35d6
SHA1 a1ff49590625758a0ee098f5b4a2edeea4e19333
SHA256 0fe08a755cdf1ebb6c64b635cb3956b74425f28e40656e9eccdca4de8cc05e3d
SHA512 fa7d29044ce2a6e7cdc69189d38ce9b3ab29ff9a55a106b5dd9ec6aeafce200d050b7885df7d7b3ac55126caf09acdb347655fdaeb6690d4de796e74312d4d63

C:\Windows\Installer\MSI970F.tmp-\Sentry.Extensions.Logging.dll

MD5 e7bc74aeee3f139d980f39dae10c2dcd
SHA1 0270a471e762200d7cbf369012d54f2173772533
SHA256 32f1baebe359c543dc77fbc3da95ab38113ae1d9edc1d4520a5d7fe6f5defa5d
SHA512 a0d110f07fee3fc1eb800420f5a653866c67b9073e63a5129d9130f25774a678541161e8696a3d17cd09689f8e4f7738b1c0e546a535b751f027d28e66c519b5

C:\Windows\Installer\MSI970F.tmp-\Sentry.dll

MD5 38b3781747ae1025772ac4b1962b55dd
SHA1 dfb0a301e2ea5646567a92e2a73c4573ab0cdd5c
SHA256 812a61bf1a21074ee22305f82a37b7c850bba67eb631489411cc36698285a006
SHA512 7df26469373eac24ed679fd93efeca67894e48da196cc215ef5132e8cbb4fef5e148302c1708b94917a7dc715d8bc6d37b161ac0a078fd134743c1d0d3d5b615

C:\Windows\Installer\MSI970F.tmp-\System.Management.Automation.dll

MD5 d5d6edd5d2ac9ae59c4c0e59d408eb04
SHA1 0ec49c3538807fa30531c18cb3d5d909470664ca
SHA256 b1324e206cf35b8ce0a631affd9927ed9bdf02f742e89140c0aa1af5f5d97600
SHA512 603f215e727f0f0704f26addd65c092bb6df7a17bc227b82e72afe068eae479ce33e6ff523000f24b0857dc72c816245fe05ed6549c7c004e48b1ca3640eb016

C:\Windows\Installer\MSI970F.tmp-\WixSharp.Msi.dll

MD5 f640c7e477a3b1524328c5680e1fd837
SHA1 b263ed19ce10de352f525dd026245d5f3fd62793
SHA256 34dbd8a746a6e017712094988864a47d131c1a5743770c0d5b25c583b2c8af78
SHA512 dc395b7635afaaded4487d9c04085652dac0e6b6bfc3912e850f6a3f2cf6eafc8546ecc3389a3068f1abac894087690ada51a836cac9efa32e9e1d87a9f2a367

C:\Windows\Installer\MSI970F.tmp-\WixSharp.UI.dll

MD5 73a49586775676e27bba42b7d4877aa1
SHA1 9a989f850f26605f989bc88658e14ebb80ab9a96
SHA256 017b7e5848aaa5151345c0ff95b3df866e26cc89e958a28fa9d962b99353084f
SHA512 b74a23f53336d36f3aa45b1d55f262c9e0903f25295596f837cbf2606c1185e885dbf9c554eb8ae4e40c157b4845956ddafb31f46beee32c2958e1b2b82b3670

memory/4008-2611-0x0000000073DF0000-0x00000000745A0000-memory.dmp

C:\Windows\Installer\e58c84f.msi

MD5 61207d516be40debbeec6716643c2e4b
SHA1 be1e96188a2d291611dc95f0de4a7538e61a4d69
SHA256 c22dc670b870a6f8f203b9770514021a956c6e58eee7e1486c0e14b38d256787
SHA512 e53ab04da1482656cd67e8f360a8ccdc69affa43e87caf701c7e2bef9f4e715815ede8397206d3090f6923160defb4a07fe65e065328ecd21b82de976783c2ed

C:\ProgramData\ExpressVPN\Config\p3d0hfrs.bin

MD5 0f035faac9cd9afc713beb7c9e8b99ea
SHA1 56828094dd42234dbecb6364af7a5221c097232b
SHA256 2108a3bce0698e09a0671d1c1d23b7d4293cdc0b97a7c7b7a0ffc90c79ddcfdc
SHA512 84e68aa2eecb1c859cb0a0097895960169b2949eb4bd2257858f0094d1f9dab69f4aeb05e914dff39d42e94d03adfc71bb52acf6c7af1b97a948ab8c7d347206

C:\Config.Msi\e58c84e.rbs

MD5 b84e9a021e4900c3d1ae4bc00f0d276b
SHA1 722998fc3efbadd6569080d94d31b74ad7703889
SHA256 90a3016957a233a3cbbb20bc40906e748643dc83cac50cff590152dee3c4a21f
SHA512 9240dab272fd42f12a163f22f95b27eb78848c305c1cb9c7b0a1c52e98f4a71c98e133e871885c0895050d400c51b9c854194f3dbdf16f93c0da46926abfd7e1

C:\Windows\Installer\MSICA8A.tmp

MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

C:\Users\Admin\AppData\Local\Temp\DELCDBA.tmp

MD5 05b0fc5cb5b7a3aba8d0aa7a7b4afeca
SHA1 8ac8c654a53f00b7e7a5ee6801a122e17ac65a4c
SHA256 5328eedb03cefbb184915d01c1667e7b9c3fac0a91d52532f4fbddfb490de2ea
SHA512 7eb613f4f5f88867df493b184ac5c7f101008addc61bf3d14c2eda5ce46241bc77a41aff5a70ca324bfd06abea1607639b531ac6a32a954abb88d670aea25171

C:\Users\Admin\AppData\Local\Temp\DELCDB9.tmp

MD5 dd0a1c213076c88de018a6f3646564be
SHA1 01d5477fae492568f062305fd6ac3d17d9227b7c
SHA256 abc21001f94e57821c6fb89fe5f3f2aeebf2b2b236f41e6f520cdb9e9f9c2c77
SHA512 8c4d6218f9ac2e45faccf49b16361117c36eb54c4bb18a4213f4ffb9ccaf479baefbd0695a6a7e395e814eb5cf3a4cf6bf4bfc535ce2f5e5696d52329d8c72f4

C:\Users\Admin\AppData\Local\Temp\DELCDB8.tmp

MD5 0fb9bb66f522eabafe83121c422d66c5
SHA1 492ddeb7dde8283d549222d0966d3e23aa98fd8a
SHA256 0490afdd9b00d111362a104b07c553abfc6f53292336325b79f1649059940fdd
SHA512 ceeb40c2d3a35e404ee93f8e13f7e772353f1736d13efa5c878ec371cf462188a419aa8e6ac2e080b2f58fcea01eb45fd9425f4ba39b419a91965629ef500594

C:\Users\Admin\AppData\Local\Temp\DELCDB7.tmp

MD5 e2ca3d32206d27ef62097196320b5149
SHA1 7eccaf65b4a4d27a40fae7bf74975cfc03e0f21a
SHA256 91227073892d648c36205f21dcdb8c77c619e8e88776d91721c9bc7aa338e1fa
SHA512 4f5bce725c9534db02c4afa4ed9638220a1ffd779bb4114334fa6eece36f630b5198d1ed168d5ecea7387cf29c7c9e14809ff452f0ae8bcb52ddb5b85dc44930

C:\Users\Admin\AppData\Local\Temp\DELCDD1.tmp

MD5 306c76e7c9ebb185392f05089abe813c
SHA1 739fd057d6b90b84b3a7a887990de7e947ddb2d6
SHA256 64c8180576126a5284cac1478cfe5f9301c5da75c8435855a706ebf9a628d368
SHA512 8808069101cfb7c1d894797aec62c43c95358f71186b6472cda86f4e56cd8adb278971e3b22d0b5cd5a778e3af3cc7cc526bfd15f429696dee4f0b3256a6bd87