Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
64s -
max time network
117s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
29/01/2024, 14:35
Static task
static1
Behavioral task
behavioral1
Sample
NordVPNSetup.exe
Resource
win11-20231215-en
General
-
Target
NordVPNSetup.exe
-
Size
1.7MB
-
MD5
59cb69a08fdd9cb4b0539e3356df1d4d
-
SHA1
0c773a0a76f821780c002d527bee387b98904569
-
SHA256
bea34078c360c71fcadc1a86ebd397d081f0d589913ad43970c1a3983231f522
-
SHA512
51d4f3d396d183bc5dcaaa0a26cf024fade9b5e5c0e73e1d2ee7663ba26bc55e799beb488d5bab8d8252147b33df6ea1209ebd730124a919940e899758842ec2
-
SSDEEP
24576:u7FUDowAyrTVE3U5Fg23TD2D+Fz3ifFUwo433RfFcdnOtksSm:uBuZrEUWq0t9D7l
Malware Config
Signatures
-
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\SET24F8.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET24F8.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\tapnordvpn.sys DrvInst.exe -
Executes dropped EXE 11 IoCs
pid Process 1424 NordVPNSetup.tmp 4412 NordVPNSetup.exe 3856 NordVPNSetup.tmp 1808 NordUpdaterSetup.exe 2428 NordUpdaterSetup.tmp 1156 NordUpdateService.exe 3084 NordVPNTapSetup.exe 4600 tapinstall.exe 2432 tapinstall.exe 4952 nordvpn-service.exe 4868 NordVPN.exe -
Loads dropped DLL 64 IoCs
pid Process 1424 NordVPNSetup.tmp 1424 NordVPNSetup.tmp 1424 NordVPNSetup.tmp 3856 NordVPNSetup.tmp 3856 NordVPNSetup.tmp 3856 NordVPNSetup.tmp 3856 NordVPNSetup.tmp 3856 NordVPNSetup.tmp 2428 NordUpdaterSetup.tmp 2428 NordUpdaterSetup.tmp 3408 MsiExec.exe 3408 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 2872 MsiExec.exe 1444 rundll32.exe 1444 rundll32.exe 1444 rundll32.exe 1444 rundll32.exe 1444 rundll32.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4952 nordvpn-service.exe 4868 NordVPN.exe 4868 NordVPN.exe 4868 NordVPN.exe 4868 NordVPN.exe 4952 nordvpn-service.exe 4868 NordVPN.exe 4868 NordVPN.exe 4868 NordVPN.exe 4868 NordVPN.exe 4868 NordVPN.exe 4868 NordVPN.exe 4868 NordVPN.exe 4868 NordVPN.exe 4868 NordVPN.exe -
Modifies file permissions 1 TTPs 18 IoCs
pid Process 4460 icacls.exe 1912 icacls.exe 3604 icacls.exe 2688 icacls.exe 1424 icacls.exe 784 icacls.exe 1160 icacls.exe 1708 icacls.exe 3372 icacls.exe 2100 icacls.exe 4408 icacls.exe 1696 icacls.exe 392 icacls.exe 4192 icacls.exe 2608 icacls.exe 124 icacls.exe 680 icacls.exe 2632 icacls.exe -
Unexpected DNS network traffic destination 12 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 103.86.99.100 Destination IP 103.86.96.100 Destination IP 103.86.99.100 Destination IP 103.86.96.100 Destination IP 103.86.96.100 Destination IP 103.86.99.100 Destination IP 103.86.99.100 Destination IP 103.86.99.100 Destination IP 103.86.99.100 Destination IP 103.86.99.100 Destination IP 103.86.99.100 Destination IP 103.86.96.100 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: NordVPNTapSetup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: NordVPNTapSetup.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\H: NordVPNTapSetup.exe File opened (read-only) \??\P: NordVPNTapSetup.exe File opened (read-only) \??\Q: NordVPNTapSetup.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: NordVPNTapSetup.exe File opened (read-only) \??\W: NordVPNTapSetup.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\E: NordVPNTapSetup.exe File opened (read-only) \??\J: NordVPNTapSetup.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\I: NordVPNTapSetup.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: NordVPNTapSetup.exe File opened (read-only) \??\M: NordVPNTapSetup.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: NordVPNTapSetup.exe File opened (read-only) \??\L: NordVPNTapSetup.exe File opened (read-only) \??\R: NordVPNTapSetup.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: NordVPNTapSetup.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\X: NordVPNTapSetup.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: NordVPNTapSetup.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\S: NordVPNTapSetup.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: NordVPNTapSetup.exe -
Drops file in System32 directory 34 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_59F1658D90E38DA89AB56C23C0E7D055 NordUpdateService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3fa78c81-a81d-6a47-b5ff-0cf1e9add402}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864 NordUpdateService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C NordUpdateService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864 NordUpdateService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\48B35517638A85CA46010B026C2B955A_0E2607AD9B9E618A16D313BC98EDE832 NordUpdateService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3fa78c81-a81d-6a47-b5ff-0cf1e9add402}\SET2101.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{3fa78c81-a81d-6a47-b5ff-0cf1e9add402}\SET2102.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3fa78c81-a81d-6a47-b5ff-0cf1e9add402} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_adaa9513bf256fe3\tapnordvpn.cat DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_adaa9513bf256fe3\oemvista.PNF tapinstall.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C NordUpdateService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_E3A0B2E345AA9F5A174687564C886046 NordUpdateService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3fa78c81-a81d-6a47-b5ff-0cf1e9add402}\tapnordvpn.cat DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8757A0F68C921927F887F6D56B2C1640_711B0FFDF677284507E7F65614F211FA nordvpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E NordUpdateService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48B35517638A85CA46010B026C2B955A_0E2607AD9B9E618A16D313BC98EDE832 NordUpdateService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B NordUpdateService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B NordUpdateService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_E3A0B2E345AA9F5A174687564C886046 NordUpdateService.exe File created C:\Windows\System32\DriverStore\Temp\{3fa78c81-a81d-6a47-b5ff-0cf1e9add402}\SET2100.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_adaa9513bf256fe3\tapnordvpn.sys DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1591D5F7B0682312DEC3539E38F11DA5_CD616FB4416B0E94DDA6C4C4101236DF nordvpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E NordUpdateService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_59F1658D90E38DA89AB56C23C0E7D055 NordUpdateService.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3fa78c81-a81d-6a47-b5ff-0cf1e9add402}\SET2100.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{3fa78c81-a81d-6a47-b5ff-0cf1e9add402}\SET2101.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3fa78c81-a81d-6a47-b5ff-0cf1e9add402}\SET2102.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{3fa78c81-a81d-6a47-b5ff-0cf1e9add402}\tapnordvpn.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_adaa9513bf256fe3\oemvista.inf DrvInst.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8757A0F68C921927F887F6D56B2C1640_711B0FFDF677284507E7F65614F211FA nordvpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1591D5F7B0682312DEC3539E38F11DA5_CD616FB4416B0E94DDA6C4C4101236DF nordvpn-service.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\NordVPN\7.17.5.0\NordSecurity.Communication.Ipc.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Nord.WiFiSec.dll NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-U1047.tmp NordVPNSetup.tmp File created C:\Program Files\NordUpdater\1.4.0.132\is-G60B0.tmp NordUpdaterSetup.tmp File created C:\Program Files (x86)\NordVPN network TAP\bin\amd64\tapinstall.exe msiexec.exe File opened for modification C:\Program Files\NordVPN\7.17.5.0\Grpc.Core.dll NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-HSB3J.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-486KU.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-HL1NA.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-JTAEK.tmp NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\System.Runtime.CompilerServices.Unsafe.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\mooseworkercsharp.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Microsoft.Extensions.Primitives.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Nord.Grpc.NamedPipes.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\NordVpn.Application.Services.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Vanara.PInvoke.Cryptography.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.17.13\System.Security.Cryptography.ProtectedData.dll NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-723QE.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\zh-CN\is-C1IFA.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-5RIA7.tmp NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\NordVPNApp.exe NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\NordSecurity.Communication.Ipc.Annotations.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Nord.Logging.Abstractions.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Nord.Logging.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\PropertyTools.dll NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-ENOIF.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-DBVJO.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.17.13\is-RV7BH.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.17.13\is-9ACG4.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.17.13\is-1C3PE.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\Extras\is-M06UU.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.17.13\is-4D0J9.tmp NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.17.13\ThreatProtectionService.Infrastructure.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Nord.Marshall.Core.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Nord.Communication.UpdateService.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Nordvpn.FeatureConfig.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\NordSecurity.NordVpn.ThreatProtection.Runner.dll NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-10RBR.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-0JJJE.tmp NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Microsoft.Toolkit.Uwp.Notifications.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\SharpVectors.Converters.Wpf.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.17.13\Polly.dll NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-58ETM.tmp NordVPNSetup.tmp File created C:\Program Files\NordUpdater\1.4.0.132\is-AGBSE.tmp NordUpdaterSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Microsoft.Extensions.DependencyInjection.Abstractions.dll NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-RUDHU.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-0CGM6.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-G85OB.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-OD43G.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-2QC11.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-N9KH5.tmp NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\System.Text.Encoding.CodePages.dll NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-RTTQG.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-OQD9T.tmp NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Hardcodet.NotifyIcon.Wpf.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\NLog.Extensions.Logging.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\System.Security.Cryptography.Xml.dll NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-JI2S4.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-9CBCD.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-4LHUO.tmp NordVPNSetup.tmp File created C:\Program Files\NordVPN\7.17.5.0\is-TCJH0.tmp NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\wintun.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\7.17.5.0\Grpc.Core.Api.dll NordVPNSetup.tmp File opened for modification C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.17.13\System.ValueTuple.dll NordVPNSetup.tmp -
Drops file in Windows directory 41 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI1878.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFA7B8788373F30160.TMP msiexec.exe File created C:\Windows\Installer\{97DEC5D6-2BE9-45BB-BFC5-274B851B486B}\appwindow.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI1BA8.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI1BA8.tmp-\tap-windows.h rundll32.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\Installer\MSI1819.tmp msiexec.exe File created C:\Windows\Installer\e5815ba.msi msiexec.exe File created C:\Windows\SystemTemp\~DFF5C4F8D5DF6B505A.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI171D.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\{97DEC5D6-2BE9-45BB-BFC5-274B851B486B}\appwindow.exe msiexec.exe File created C:\Windows\Installer\e5815b6.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI1BA8.tmp-\tapnordvpn.cat rundll32.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI1BA8.tmp-\OemVista.inf rundll32.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFFC7E716C295725FF.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSI1BA8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1BA8.tmp-\TapInstaller.dll rundll32.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI18C7.tmp msiexec.exe File created C:\Windows\is-E2ORJ.tmp NordVPNSetup.tmp File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{97DEC5D6-2BE9-45BB-BFC5-274B851B486B} msiexec.exe File opened for modification C:\Windows\Installer\MSI1A01.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1BA8.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File created C:\Windows\SystemTemp\~DF777154A97BAC0093.TMP msiexec.exe File opened for modification C:\Windows\SystemTemp\Tmp8B44.tmp nordvpn-service.exe File opened for modification C:\Windows\Nord.Setup.dll NordVPNSetup.tmp File opened for modification C:\Windows\SystemTemp\Tmp8B43.tmp nordvpn-service.exe File opened for modification C:\Windows\SystemTemp\Tmp8B45.tmp nordvpn-service.exe File opened for modification C:\Windows\Installer\MSI1BA8.tmp-\tapnordvpn.sys rundll32.exe File opened for modification C:\Windows\Installer\MSI17F9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI18F7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1BA8.tmp-\tapinstall.exe rundll32.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File opened for modification C:\Windows\SystemTemp\Tmp8B46.tmp nordvpn-service.exe File opened for modification C:\Windows\Installer\e5815b6.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe -
Kills process with taskkill 1 IoCs
pid Process 3672 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs NordUpdateService.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates NordUpdateService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs NordUpdateService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs NordUpdateService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates nordvpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates NordUpdateService.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople NordUpdateService.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" DrvInst.exe -
Modifies registry class 39 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1199853020-417986905-91977573-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DA4E71A7BB81AF54687507D7092C0497\6D5CED799EB2BB54FB5C72B458B184B6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\Clients = 3a0000000000 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\Version = "16777217" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\ProductIcon = "C:\\Windows\\Installer\\{97DEC5D6-2BE9-45BB-BFC5-274B851B486B}\\appwindow.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN.Notification\shell\open\command\ = "\"C:\\Program Files\\NordVPN\\NordVPN.exe\" \"%1\"" NordVPNSetup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6D5CED799EB2BB54FB5C72B458B184B6\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN\URL Protocol NordVPNSetup.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DA4E71A7BB81AF54687507D7092C0497 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN\ = "URL:NordVPN Protocol" NordVPNSetup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN.Notification\URL Protocol NordVPNSetup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN.Notification\shell NordVPNSetup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\SourceList msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN\shell NordVPNSetup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN\shell\open NordVPNSetup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN\shell\open\command\ = "\"C:\\Program Files\\NordVPN\\NordVPN.exe\" \"%1\"" NordVPNSetup.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN.Notification NordVPNSetup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN.Notification\ = "URL:NordVPN.Notification" NordVPNSetup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN.Notification\shell\open NordVPNSetup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6D5CED799EB2BB54FB5C72B458B184B6 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\ProductName = "NordVPN network TAP" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\PackageCode = "73A7256C089BA9142B6715C3DEB683BE" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\SourceList\PackageName = "NordVPNTapSetup.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{97DEC5D6-2BE9-45BB-BFC5-274B851B486B}\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\SourceList\Media\1 = "Disk1;Disk1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN\shell\open\command NordVPNSetup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN.Notification\shell\open\command NordVPNSetup.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6D5CED799EB2BB54FB5C72B458B184B6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\{97DEC5D6-2BE9-45BB-BFC5-274B851B486B}\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NordVPN NordVPNSetup.tmp -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD NordVPNSetup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f NordVPNSetup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 NordVPNSetup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5EEED86FA37C675230642F55C84DDBF67CD33C80\Blob = 0f000000010000003000000082ef60cde833832df196a3351df5b2b90029e31f679cec503aeea7ca8893db9d81d4e576a9f216dd0baec61cb02a14600b00000001000000380000004400690067006900430065007200740020004300530020005200530041003400300039003600200052006f006f00740020004700350000006200000001000000200000007353b6d6c2d6da4247773f3f07d075decb5134212bead0928ef1f4611526094153000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000680193b1d24a40426994462c1c5a88a925b4474f1d0000000100000010000000cfa020613a558555d3c1ea201f6276da0300000001000000140000005eeed86fa37c675230642f55c84ddbf67cd33c80200000000100000068050000308205643082034ca003020102021006cee131be6d55c807f7c0c7fb44e620300d06092a864886f70d01010c0500304c310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e312430220603550403131b4469676943657274204353205253413430393620526f6f74204735301e170d3231303131353030303030305a170d3436303131343233353935395a304c310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e312430220603550403131b4469676943657274204353205253413430393620526f6f7420473530820222300d06092a864886f70d01010105000382020f003082020a0282020100b6337380d8620370142c111c395e7cae7c83861dfe262f4c24ad8bea835fa9bc3d5bfc0b984c024730ece2feece8345b665ebf3bd72ca625ff8c59b3dfeada7c29d9465072081d6ed11b0add1fcd9989fa0f0f73c4e19c1d7532cd6f97da2a6a95b26cc909d0ea0b7b7d17064999efd6dee0c853d4aec677f186bb231cb8c0df59f78e7dd1ef82e6268b5a38b5ff75d5b2d94f09f3378850da11a48a1414d15304007df36a4418fe507032071ca89a0e3a1dc50a1f6e0b2669b73ca257702c86fa4c6e95a95843b9ac12d6ff3fedd743176b4cce9ec490abfffa10509aa39057d6e78c10ae9f161acf351d7fd776ed8a9c35a728b8a75d21fc3037ddde08194f15c6e7a6da90478ef794534c8e5302befd99e5ea86d0af0302d39baa93f1ab288e2001ff4cfbccb72940f587a41213051f436ed751509f38b420ed1709128fccb919af9fcdbe6911d3af55106d1786799652c6b2009de5af38b035f4886b8f0e043d7ceeafcdd36a104ac6cd86ca223da14a5cfb0eff88df5c62a7c0b91ed9ac6c7e3837fe779325c2858a4fb537065a068114f1ce949d9991ea325ace673d6e0466ad0c4f2da32ef79ef5789df70afd7e8fe3428a5596bcf19f372dfc9e5f95fe8c181bfc8efd4b90afd703681263ace293a7a2cb04e54f64ce03fac6149fd98be8ccd4628c6be4002c199f1a06c6318154fb53249aaf5599ba9d75aeb8c2dd0203010001a3423040301d0603551d0e04160414680193b1d24a40426994462c1c5a88a925b4474f300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c0500038202010092fceeb802791702517d21c54967a7a4f1a82438eb0c68ea5a426b9cf473c1694a2db33705504298929e06792c2e0699f6efdf2ba0cdb3920183b5a0cb27b53c231a9849a2ec2d99a55943acd2b193d657d71cbc93d6c640e1b36f1955b713d7e54333a4b5abcbdac131640d74d62cedc38d6eebbbaf194761612dc0f405b96f78dc3af74240655391bd990d939254a6a937592b9bcb99c6bc3df70484f094331d0f825a39cb2e45c32819a3b29b98c8fc316b608ff6e98628bce03c7d745d16895b6924c7108bc44bbb364fd4593fc3b0a49199f82ed14a019df58812efbf5a116a594f596b5a67f38fb4130fc0d82f3d2872aa197f117d6a5b9f95e75fb7944ff13ea15aff2dcc9ddf27778f32731c670a76f3fa5cb1bfbc1dbd0c289bb2c717670b330fc3bd36dcfbba420babed84c362d68416a9b1076ba96eeec6cfe6b04429c2f0b361802a8b6fd2145c25875464f3a44cc1a1f8a76beafeea3afc79db0e8fdcc6f3c9d46cdee983a18e1d22ecc93ab2007bdc3ba7421a7fdc8ba9113d8ea7c0206f5d095d4344e68f66cca95b07f1ef9b7a0eb354e194fd0e2cc693d755fd719835b8094affc629282cf6522ddb14189227e2167e8ccad461be828791eb98373fbf5f5d773f34ac1b3843ab687299321e3a1a19a5a3384c23d7a3e7ccd52a9217900b5a4bbd16bdfb866ae28999ece4a05518c9a3081f13e0320872d0 NordVPN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 NordVPNSetup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 NordVPNSetup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5EEED86FA37C675230642F55C84DDBF67CD33C80\Blob = 19000000010000001000000016aee18d205d4e54b5aee9b3c1466a210300000001000000140000005eeed86fa37c675230642f55c84ddbf67cd33c801d0000000100000010000000cfa020613a558555d3c1ea201f6276da140000000100000014000000680193b1d24a40426994462c1c5a88a925b4474f090000000100000016000000301406082b0601050507030306082b0601050507030853000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007353b6d6c2d6da4247773f3f07d075decb5134212bead0928ef1f461152609410b00000001000000380000004400690067006900430065007200740020004300530020005200530041003400300039003600200052006f006f00740020004700350000000f000000010000003000000082ef60cde833832df196a3351df5b2b90029e31f679cec503aeea7ca8893db9d81d4e576a9f216dd0baec61cb02a1460200000000100000068050000308205643082034ca003020102021006cee131be6d55c807f7c0c7fb44e620300d06092a864886f70d01010c0500304c310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e312430220603550403131b4469676943657274204353205253413430393620526f6f74204735301e170d3231303131353030303030305a170d3436303131343233353935395a304c310b300906035504061302555331173015060355040a130e44696769436572742c20496e632e312430220603550403131b4469676943657274204353205253413430393620526f6f7420473530820222300d06092a864886f70d01010105000382020f003082020a0282020100b6337380d8620370142c111c395e7cae7c83861dfe262f4c24ad8bea835fa9bc3d5bfc0b984c024730ece2feece8345b665ebf3bd72ca625ff8c59b3dfeada7c29d9465072081d6ed11b0add1fcd9989fa0f0f73c4e19c1d7532cd6f97da2a6a95b26cc909d0ea0b7b7d17064999efd6dee0c853d4aec677f186bb231cb8c0df59f78e7dd1ef82e6268b5a38b5ff75d5b2d94f09f3378850da11a48a1414d15304007df36a4418fe507032071ca89a0e3a1dc50a1f6e0b2669b73ca257702c86fa4c6e95a95843b9ac12d6ff3fedd743176b4cce9ec490abfffa10509aa39057d6e78c10ae9f161acf351d7fd776ed8a9c35a728b8a75d21fc3037ddde08194f15c6e7a6da90478ef794534c8e5302befd99e5ea86d0af0302d39baa93f1ab288e2001ff4cfbccb72940f587a41213051f436ed751509f38b420ed1709128fccb919af9fcdbe6911d3af55106d1786799652c6b2009de5af38b035f4886b8f0e043d7ceeafcdd36a104ac6cd86ca223da14a5cfb0eff88df5c62a7c0b91ed9ac6c7e3837fe779325c2858a4fb537065a068114f1ce949d9991ea325ace673d6e0466ad0c4f2da32ef79ef5789df70afd7e8fe3428a5596bcf19f372dfc9e5f95fe8c181bfc8efd4b90afd703681263ace293a7a2cb04e54f64ce03fac6149fd98be8ccd4628c6be4002c199f1a06c6318154fb53249aaf5599ba9d75aeb8c2dd0203010001a3423040301d0603551d0e04160414680193b1d24a40426994462c1c5a88a925b4474f300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff300d06092a864886f70d01010c0500038202010092fceeb802791702517d21c54967a7a4f1a82438eb0c68ea5a426b9cf473c1694a2db33705504298929e06792c2e0699f6efdf2ba0cdb3920183b5a0cb27b53c231a9849a2ec2d99a55943acd2b193d657d71cbc93d6c640e1b36f1955b713d7e54333a4b5abcbdac131640d74d62cedc38d6eebbbaf194761612dc0f405b96f78dc3af74240655391bd990d939254a6a937592b9bcb99c6bc3df70484f094331d0f825a39cb2e45c32819a3b29b98c8fc316b608ff6e98628bce03c7d745d16895b6924c7108bc44bbb364fd4593fc3b0a49199f82ed14a019df58812efbf5a116a594f596b5a67f38fb4130fc0d82f3d2872aa197f117d6a5b9f95e75fb7944ff13ea15aff2dcc9ddf27778f32731c670a76f3fa5cb1bfbc1dbd0c289bb2c717670b330fc3bd36dcfbba420babed84c362d68416a9b1076ba96eeec6cfe6b04429c2f0b361802a8b6fd2145c25875464f3a44cc1a1f8a76beafeea3afc79db0e8fdcc6f3c9d46cdee983a18e1d22ecc93ab2007bdc3ba7421a7fdc8ba9113d8ea7c0206f5d095d4344e68f66cca95b07f1ef9b7a0eb354e194fd0e2cc693d755fd719835b8094affc629282cf6522ddb14189227e2167e8ccad461be828791eb98373fbf5f5d773f34ac1b3843ab687299321e3a1a19a5a3384c23d7a3e7ccd52a9217900b5a4bbd16bdfb866ae28999ece4a05518c9a3081f13e0320872d0 NordVPN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f NordVPNSetup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 NordVPNSetup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f NordVPNSetup.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5EEED86FA37C675230642F55C84DDBF67CD33C80 NordVPN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f NordVPNSetup.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 NordVPNSetup.tmp -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1424 NordVPNSetup.tmp 1424 NordVPNSetup.tmp 3672 msiexec.exe 3672 msiexec.exe 3856 NordVPNSetup.tmp 3856 NordVPNSetup.tmp 4868 NordVPN.exe 4868 NordVPN.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 684 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1424 NordVPNSetup.tmp Token: SeDebugPrivilege 3856 NordVPNSetup.tmp Token: SeDebugPrivilege 3672 msiexec.exe Token: SeSecurityPrivilege 3672 msiexec.exe Token: SeCreateTokenPrivilege 3084 NordVPNTapSetup.exe Token: SeAssignPrimaryTokenPrivilege 3084 NordVPNTapSetup.exe Token: SeLockMemoryPrivilege 3084 NordVPNTapSetup.exe Token: SeIncreaseQuotaPrivilege 3084 NordVPNTapSetup.exe Token: SeMachineAccountPrivilege 3084 NordVPNTapSetup.exe Token: SeTcbPrivilege 3084 NordVPNTapSetup.exe Token: SeSecurityPrivilege 3084 NordVPNTapSetup.exe Token: SeTakeOwnershipPrivilege 3084 NordVPNTapSetup.exe Token: SeLoadDriverPrivilege 3084 NordVPNTapSetup.exe Token: SeSystemProfilePrivilege 3084 NordVPNTapSetup.exe Token: SeSystemtimePrivilege 3084 NordVPNTapSetup.exe Token: SeProfSingleProcessPrivilege 3084 NordVPNTapSetup.exe Token: SeIncBasePriorityPrivilege 3084 NordVPNTapSetup.exe Token: SeCreatePagefilePrivilege 3084 NordVPNTapSetup.exe Token: SeCreatePermanentPrivilege 3084 NordVPNTapSetup.exe Token: SeBackupPrivilege 3084 NordVPNTapSetup.exe Token: SeRestorePrivilege 3084 NordVPNTapSetup.exe Token: SeShutdownPrivilege 3084 NordVPNTapSetup.exe Token: SeDebugPrivilege 3084 NordVPNTapSetup.exe Token: SeAuditPrivilege 3084 NordVPNTapSetup.exe Token: SeSystemEnvironmentPrivilege 3084 NordVPNTapSetup.exe Token: SeChangeNotifyPrivilege 3084 NordVPNTapSetup.exe Token: SeRemoteShutdownPrivilege 3084 NordVPNTapSetup.exe Token: SeUndockPrivilege 3084 NordVPNTapSetup.exe Token: SeSyncAgentPrivilege 3084 NordVPNTapSetup.exe Token: SeEnableDelegationPrivilege 3084 NordVPNTapSetup.exe Token: SeManageVolumePrivilege 3084 NordVPNTapSetup.exe Token: SeImpersonatePrivilege 3084 NordVPNTapSetup.exe Token: SeCreateGlobalPrivilege 3084 NordVPNTapSetup.exe Token: SeDebugPrivilege 1156 NordUpdateService.exe Token: SeCreateTokenPrivilege 3084 NordVPNTapSetup.exe Token: SeAssignPrimaryTokenPrivilege 3084 NordVPNTapSetup.exe Token: SeLockMemoryPrivilege 3084 NordVPNTapSetup.exe Token: SeIncreaseQuotaPrivilege 3084 NordVPNTapSetup.exe Token: SeMachineAccountPrivilege 3084 NordVPNTapSetup.exe Token: SeTcbPrivilege 3084 NordVPNTapSetup.exe Token: SeSecurityPrivilege 3084 NordVPNTapSetup.exe Token: SeTakeOwnershipPrivilege 3084 NordVPNTapSetup.exe Token: SeLoadDriverPrivilege 3084 NordVPNTapSetup.exe Token: SeSystemProfilePrivilege 3084 NordVPNTapSetup.exe Token: SeSystemtimePrivilege 3084 NordVPNTapSetup.exe Token: SeProfSingleProcessPrivilege 3084 NordVPNTapSetup.exe Token: SeIncBasePriorityPrivilege 3084 NordVPNTapSetup.exe Token: SeCreatePagefilePrivilege 3084 NordVPNTapSetup.exe Token: SeCreatePermanentPrivilege 3084 NordVPNTapSetup.exe Token: SeBackupPrivilege 3084 NordVPNTapSetup.exe Token: SeRestorePrivilege 3084 NordVPNTapSetup.exe Token: SeShutdownPrivilege 3084 NordVPNTapSetup.exe Token: SeDebugPrivilege 3084 NordVPNTapSetup.exe Token: SeAuditPrivilege 3084 NordVPNTapSetup.exe Token: SeSystemEnvironmentPrivilege 3084 NordVPNTapSetup.exe Token: SeChangeNotifyPrivilege 3084 NordVPNTapSetup.exe Token: SeRemoteShutdownPrivilege 3084 NordVPNTapSetup.exe Token: SeUndockPrivilege 3084 NordVPNTapSetup.exe Token: SeSyncAgentPrivilege 3084 NordVPNTapSetup.exe Token: SeEnableDelegationPrivilege 3084 NordVPNTapSetup.exe Token: SeManageVolumePrivilege 3084 NordVPNTapSetup.exe Token: SeImpersonatePrivilege 3084 NordVPNTapSetup.exe Token: SeCreateGlobalPrivilege 3084 NordVPNTapSetup.exe Token: SeCreateTokenPrivilege 3084 NordVPNTapSetup.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1424 NordVPNSetup.tmp 3856 NordVPNSetup.tmp 2428 NordUpdaterSetup.tmp 3084 NordVPNTapSetup.exe 3084 NordVPNTapSetup.exe 3856 NordVPNSetup.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1588 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 1424 844 NordVPNSetup.exe 79 PID 844 wrote to memory of 1424 844 NordVPNSetup.exe 79 PID 844 wrote to memory of 1424 844 NordVPNSetup.exe 79 PID 1424 wrote to memory of 4412 1424 NordVPNSetup.tmp 81 PID 1424 wrote to memory of 4412 1424 NordVPNSetup.tmp 81 PID 1424 wrote to memory of 4412 1424 NordVPNSetup.tmp 81 PID 4412 wrote to memory of 3856 4412 NordVPNSetup.exe 82 PID 4412 wrote to memory of 3856 4412 NordVPNSetup.exe 82 PID 4412 wrote to memory of 3856 4412 NordVPNSetup.exe 82 PID 3856 wrote to memory of 3672 3856 NordVPNSetup.tmp 109 PID 3856 wrote to memory of 3672 3856 NordVPNSetup.tmp 109 PID 3856 wrote to memory of 3672 3856 NordVPNSetup.tmp 109 PID 3856 wrote to memory of 1808 3856 NordVPNSetup.tmp 86 PID 3856 wrote to memory of 1808 3856 NordVPNSetup.tmp 86 PID 3856 wrote to memory of 1808 3856 NordVPNSetup.tmp 86 PID 1808 wrote to memory of 2428 1808 NordUpdaterSetup.exe 87 PID 1808 wrote to memory of 2428 1808 NordUpdaterSetup.exe 87 PID 1808 wrote to memory of 2428 1808 NordUpdaterSetup.exe 87 PID 2428 wrote to memory of 1708 2428 NordUpdaterSetup.tmp 88 PID 2428 wrote to memory of 1708 2428 NordUpdaterSetup.tmp 88 PID 2428 wrote to memory of 1160 2428 NordUpdaterSetup.tmp 100 PID 2428 wrote to memory of 1160 2428 NordUpdaterSetup.tmp 100 PID 2428 wrote to memory of 784 2428 NordUpdaterSetup.tmp 92 PID 2428 wrote to memory of 784 2428 NordUpdaterSetup.tmp 92 PID 2428 wrote to memory of 1696 2428 NordUpdaterSetup.tmp 99 PID 2428 wrote to memory of 1696 2428 NordUpdaterSetup.tmp 99 PID 2428 wrote to memory of 2632 2428 NordUpdaterSetup.tmp 94 PID 2428 wrote to memory of 2632 2428 NordUpdaterSetup.tmp 94 PID 2428 wrote to memory of 4460 2428 NordUpdaterSetup.tmp 95 PID 2428 wrote to memory of 4460 2428 NordUpdaterSetup.tmp 95 PID 2428 wrote to memory of 1912 2428 NordUpdaterSetup.tmp 97 PID 2428 wrote to memory of 1912 2428 NordUpdaterSetup.tmp 97 PID 2428 wrote to memory of 4408 2428 NordUpdaterSetup.tmp 104 PID 2428 wrote to memory of 4408 2428 NordUpdaterSetup.tmp 104 PID 2428 wrote to memory of 392 2428 NordUpdaterSetup.tmp 106 PID 2428 wrote to memory of 392 2428 NordUpdaterSetup.tmp 106 PID 3856 wrote to memory of 3084 3856 NordVPNSetup.tmp 108 PID 3856 wrote to memory of 3084 3856 NordVPNSetup.tmp 108 PID 3856 wrote to memory of 3084 3856 NordVPNSetup.tmp 108 PID 3672 wrote to memory of 3408 3672 msiexec.exe 112 PID 3672 wrote to memory of 3408 3672 msiexec.exe 112 PID 3672 wrote to memory of 3408 3672 msiexec.exe 112 PID 3084 wrote to memory of 4808 3084 NordVPNTapSetup.exe 113 PID 3084 wrote to memory of 4808 3084 NordVPNTapSetup.exe 113 PID 3084 wrote to memory of 4808 3084 NordVPNTapSetup.exe 113 PID 3672 wrote to memory of 2872 3672 msiexec.exe 114 PID 3672 wrote to memory of 2872 3672 msiexec.exe 114 PID 3672 wrote to memory of 2872 3672 msiexec.exe 114 PID 2872 wrote to memory of 1444 2872 MsiExec.exe 115 PID 2872 wrote to memory of 1444 2872 MsiExec.exe 115 PID 2872 wrote to memory of 1444 2872 MsiExec.exe 115 PID 1444 wrote to memory of 4600 1444 rundll32.exe 116 PID 1444 wrote to memory of 4600 1444 rundll32.exe 116 PID 1444 wrote to memory of 2432 1444 rundll32.exe 119 PID 1444 wrote to memory of 2432 1444 rundll32.exe 119 PID 1836 wrote to memory of 724 1836 svchost.exe 121 PID 1836 wrote to memory of 724 1836 svchost.exe 121 PID 1836 wrote to memory of 568 1836 svchost.exe 122 PID 1836 wrote to memory of 568 1836 svchost.exe 122 PID 3856 wrote to memory of 3372 3856 NordVPNSetup.tmp 126 PID 3856 wrote to memory of 3372 3856 NordVPNSetup.tmp 126 PID 3856 wrote to memory of 2100 3856 NordVPNSetup.tmp 128 PID 3856 wrote to memory of 2100 3856 NordVPNSetup.tmp 128 PID 3856 wrote to memory of 4192 3856 NordVPNSetup.tmp 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\is-UCSB2.tmp\NordVPNSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-UCSB2.tmp\NordVPNSetup.tmp" /SL5="$6019E,890440,866304,C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\is-O4P64.tmp\NordVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-O4P64.tmp\NordVPNSetup.exe" /webinstaller=true /DIR="C:\Program Files\NordVPN" /guid=247467d8-32d4-4b13-8f56-f02f0417fef63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\is-UVNFM.tmp\NordVPNSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-UVNFM.tmp\NordVPNSetup.tmp" /SL5="$F0070,45468936,866304,C:\Users\Admin\AppData\Local\Temp\is-O4P64.tmp\NordVPNSetup.exe" /webinstaller=true /DIR="C:\Program Files\NordVPN" /guid=247467d8-32d4-4b13-8f56-f02f0417fef64⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /f /im NordVPN.exe5⤵
- Kills process with taskkill
PID:3672
-
-
C:\Users\Admin\AppData\Local\Temp\is-N137E.tmp\NordUpdaterSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-N137E.tmp\NordUpdaterSetup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /RESTARTEXITCODE=3010 /NOCLOSEAPPLICATIONS5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\is-LD72K.tmp\NordUpdaterSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-LD72K.tmp\NordUpdaterSetup.tmp" /SL5="$90058,2403212,910336,C:\Users\Admin\AppData\Local\Temp\is-N137E.tmp\NordUpdaterSetup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /RESTARTEXITCODE=3010 /NOCLOSEAPPLICATIONS6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\NordUpdater" /inheritance:r7⤵
- Modifies file permissions
PID:1708
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\NordUpdater" /grant *S-1-5-32-544:(OI)(CI)(F)7⤵
- Modifies file permissions
PID:784
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\NordUpdater /inheritance:d7⤵
- Modifies file permissions
PID:2632
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\NordUpdater /remove Users /T7⤵
- Modifies file permissions
PID:4460
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\NordUpdater /grant Users:(RX)7⤵
- Modifies file permissions
PID:1912
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\NordUpdater" /grant *S-1-5-18:(OI)(CI)(F)7⤵
- Modifies file permissions
PID:1696
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\NordUpdater" /grant *S-1-5-32-545:(OI)(CI)(RX)7⤵
- Modifies file permissions
PID:1160
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\NordUpdater\logs /grant Users:(OI)(CI)(RX)7⤵
- Modifies file permissions
PID:4408
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\NordUpdater\updates /grant Users:(OI)(CI)(RX)7⤵
- Modifies file permissions
PID:392
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-N137E.tmp\NordVPNTapSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-N137E.tmp\NordVPNTapSetup.exe" /qn /norestart5⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i C:\Users\Admin\AppData\Local\Temp\{97DEC5D6-2BE9-45BB-BFC5-274B851B486B}\NordVPNTapSetup.msi /qn /norestart AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-N137E.tmp\NordVPNTapSetup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-N137E.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1706298328 /qn /norestart " REBOOT="ReallySuppress" AI_EUIMSI=""6⤵
- Enumerates connected drives
PID:4808
-
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN /inheritance:d5⤵
- Modifies file permissions
PID:3372
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN /remove Users /T5⤵
- Modifies file permissions
PID:2100
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN /grant Users:(RX)5⤵
- Modifies file permissions
PID:4192
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN\logs /grant Users:(OI)(CI)(RX)5⤵
- Modifies file permissions
PID:2608
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN\affiliates.json /grant Users:(RX)5⤵
- Modifies file permissions
PID:124
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\NordVPN" /inheritance:r5⤵
- Modifies file permissions
PID:680
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\NordVPN" /grant *S-1-5-32-545:(OI)(CI)(RX)5⤵
- Modifies file permissions
PID:3604
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\NordVPN" /grant *S-1-5-32-544:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:2688
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" "C:\Program Files\NordVPN" /grant *S-1-5-18:(OI)(CI)(F)5⤵
- Modifies file permissions
PID:1424
-
-
C:\Program Files\NordVPN\NordVPN.exe"C:\Program Files\NordVPN\NordVPN.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:4868
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1588
-
C:\Program Files\NordUpdater\NordUpdateService.exe"C:\Program Files\NordUpdater\NordUpdateService.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding AA8409D8C523C5F34A5AE3F95BD92F2E C2⤵
- Loads dropped DLL
PID:3408
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F9D35EE2684574EA66C0B96FDEB537E62⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\Installer\MSI1BA8.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240655265 31 TapInstaller!TapInstaller.CustomActions.InstallTapAdapter3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Program Files (x86)\NordVPN network TAP\bin\amd64\tapinstall.exe"C:\Program Files (x86)\NordVPN network TAP\bin\amd64\tapinstall.exe" hwids tapnordvpn4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4600
-
-
C:\Program Files (x86)\NordVPN network TAP\bin\amd64\tapinstall.exe"C:\Program Files (x86)\NordVPN network TAP\bin\amd64\tapinstall.exe" install OemVista.inf tapnordvpn4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2432
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{edb058f6-6ca0-e043-bd15-3d60e5b53447}\oemvista.inf" "9" "4166dbbc3" "0000000000000154" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\nordvpn network tap\win10\amd64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:724
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tapnordvpn.ndi:9.0.0.23:tapnordvpn," "4166dbbc3" "0000000000000154" "1ba8"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:568
-
-
C:\Program Files\NordVPN\nordvpn-service.exe"C:\Program Files\NordVPN\nordvpn-service.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4952
-
C:\Program Files\NordVPN\NordVPN.exe"C:\Program Files\NordVPN\NordVPN.exe"1⤵PID:4596
-
C:\Program Files\NordVPN\NordVPN.exe"C:\Program Files\NordVPN\NordVPN.exe"1⤵PID:1444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD54f8cc5d7c25f3279ad8b1917ab4fbab8
SHA1c6b47038be5375bea6e6ba6037cfccfa2a5b2690
SHA2568baee530554a648e3e075587caefc1ef4db0a21cfe6e5317c326162d8078f139
SHA512d6ae93ef0228fb37be2b603995b173c305a4c5740d5214c1e751f2c10ee3b52fc3548c9826c7dfe872276c4b3386bc0f078e71c3d4346003dd88241d642ef435
-
Filesize
80KB
MD51bc1d751742450b1f6152b8c98c97efd
SHA16146837ee8e91f130ce7227a4d04f190f7ea3981
SHA256e35b3f5c852d0c73026f3f2277db617c5d5b873a0f191a6a7032038961d183db
SHA512be6f55957627ba91a7ed1f07066b0b2d0895b3d61f9ce2640ff97029e1d9f77b0633710c3f37b169284fd617e263381f95e20f7726e993a1517074c7dc142b02
-
Filesize
53KB
MD5c1d3b66758603cfecff234350c88c4e7
SHA19dffb8b209459d25213ba144e3a562d99d17c7ac
SHA256b620fb49adb5ab9a3f0d58d58af4ff1f6cf9aaef2efd99ef41bd925aa33604ca
SHA5128b4c2d6ab53ecceb9ec28a4adefc3b6057b5c7e4247a8df0f1eee21f5ff2d245b845b91cca2d0a96a5cc91e5c9c95d8e74d10b1a2377574cab9fe721b9308ffa
-
Filesize
396KB
MD5f24ab4c4d68c22dac223ad26baede9e7
SHA142a56c0f684aef47eeef045439c66323b0e43fb4
SHA25600c735be2d799719db389badc09611889bbd18b4f5b374854bc129a468f63d66
SHA5122b794bad3de3dec2aca6ccfcb24e88d778578fc85626cc8980d93fb3171cdfec38258c086888241c68cbae4658103645842843b4fafd778a7543689630eb757a
-
Filesize
59KB
MD515cec4da89c7710437de940f155de3d5
SHA13381c163a1a5f9bfcaa8d2b2d7d7a314a41a6dfc
SHA256de820e654c201ed6dcfabc795f0acc675ede74155f8f1aa2986d5b9190970116
SHA512fbe6e3f1566b79843941fa4a3a56c5859435a7be88acac6fa865d164fd6d4b21bec8ce14bca66693502ce798a0390c5e465d076c180571e2149e7746a2eee8ac
-
Filesize
16KB
MD53a8369977cc5a2bceabb14cf2131741a
SHA1e75ac192e47ab0bd92fd21eb0373d59608169d7b
SHA25641671e91a4349c424ec2a1b1a8dd2a596ea9f488830a7eebe270cf6624b5336e
SHA512b18e70fdb0a91e17fdf7d027fc75d165cb10f2b94ce106a11d197066ff95c8d43c3681c3f83908e128dd3df5c0098d9a4e431ac0bf761d3c254e745ed2b1494a
-
Filesize
113KB
MD51330a8ab50fb43c1111096c6317978e4
SHA12306fa83ced22301171c3c67d5be415990630b90
SHA256186c0bd673dc4cbfa9c82ba22f67a96d9f8c32347f9cbc4b6fae85b34088cc07
SHA5122d1d9699ce6a300598d88272f1cab08489985bdc1ca4d8117e1829cf0251981ca7c60a1310e472bb3d10760bd933609140531bdce86e82d091ee028ed4ec51b6
-
Filesize
23KB
MD5fa4a4082e2272f0910ac02d0317c8eb4
SHA13c5bf3869a17b8e42bb718805c1e8a4637825e8a
SHA2563c2ff4b2ed7f4af1c2fcab8465fcfbf3cca7cae5a1390f904d0670ab8127c05f
SHA51215d65c620cbf18d743a804a5d24f1c2526ddc08e4a9906b4cef44c57bcf49a54a0545d5ae69a1c9086522575e58c9f4cd060b02868f3d10f91f9cecd9a508d85
-
Filesize
48KB
MD5fd33413040fc8ff42229e10e70a1c237
SHA122477b09df7eab56f9545134a5ad311b6cd8381b
SHA256d74bc4c6e5f912562145631708551f406b019fb34c0f64b33bb7c515cc1b49c7
SHA512f97d7428c4a30f56b76b3420234ccc5394a5bd16da297b672a9166e7b219db1471210991cc3f4c37ad22acd8fa2586d10c80ddfa05ae2056dc049737b243ca24
-
Filesize
84KB
MD50deb4bdc08c989ee7a9efbce750d9866
SHA1f1da915c8af355ac0a4adfc9ae7b94c702982a8b
SHA256d7f9024cdb38d5cd60f078334305270175a0d312a3efb4fed588d6469d2773ca
SHA512f9ba208e89645abbab371f445accff1245b118da269af3c15f0337bced6986743e42bfac9b77b9acbafd707040face09ad484358648ae55054cd6bf89892e446
-
Filesize
28KB
MD54a42266f1740c45516f0b7f34a91b166
SHA141ed4dab44c3c76dfa0255dc185c698991779d11
SHA256debbfa4155f51df10f93e80140b5ba15feadd7d426b5740717b1cca7f3399e56
SHA51203938ec0e7742903a7270727d67cd5c4783bef6ccc3f7b8ba9937bd929f62a564ffa2c400ff951f909c7f2067947c29234ded0368d28b124e2c2a7610074390e
-
Filesize
841KB
MD5f8e34891ec6624d8d14b7beb2943bd63
SHA1cffff1f52b06a6cedbf21b659d459cc367f894de
SHA25693423b1b929d0fae4fc965427615391d5ce8f035d5e6d2e0d6fd5e8f951fe5e0
SHA512f629551c620bc0fc161ef5306cc3498e24fd213d153b32c0a08a837dcb53ee64f48ab49a0e9be0c91b35e03d263bef4d3639300f71427a0bac7ae69e52b02948
-
Filesize
689KB
MD56daa18570499bb8e76d82c8a92161951
SHA19262f9e0ab1ffcb609d057468727a5ec1c1de815
SHA2565cda486f4ba6c4a790b1769eb7bc1bb4c1405e453ca5b48783fbb4af44ce7251
SHA5125ae615d893f362c61f236f17c7bf113a596d8f61fe4fcd9689810eec1f19d146f83def8b753bdc1fcd4128e6b41881510a24ee3066df7cdf687e0375d32df72f
-
Filesize
35KB
MD5995a882b0fef7752fbeb4286726a4470
SHA12d3f8fbc23dd6e200479fb4904674bd23dd4c801
SHA256802ad8807b75c5527e9df15394fb24779cae78bd2a36ad667debabcdd0be41f1
SHA512bf0e05298ba0beabf65a8b695e544119133ea14e8b7c1d43e0f3e14d27ef84e4d0daed1d4ac79cb4f02b7caf0552f401153025151ed9ec8f7e77ab3f60b11bf3
-
Filesize
78KB
MD5645f2664b566abb5f08fade136ad24a3
SHA112d67c360886142dc080a2eecbc7a079529cec86
SHA256a3931a653e781480b8230f5046b14f3cf5803097d956b117ac554f0c5604574a
SHA512f42d2258a631aeccd4879c9561e096268166ae62923f98a8b550cc198e35418667fbd8859597bdd7d292ee9f655531253d8177fd590e511c83862017a265b078
-
Filesize
58KB
MD50de07786aec2fca83ef454e07185bd53
SHA18e7d3cda989e31372e14fef4ff908f71966af106
SHA256a6b9a8655609a4ebeca2b71d6e253a62f4385267c9d61af455960ea4ecb3271c
SHA512aacaa710fdf6ab5298d0994c35a0f65bf4dd11378c98cf731c69650e19bd6a34ac2746af2a6ddd566db493bc179849359cba82d6727390a07e37c90f3a57f3b6
-
Filesize
69KB
MD5a8248b9a9d53f451505ecb313430b088
SHA1d431fa16cad7e264416143a4e47b16e6eec8091f
SHA2561508ce239fcf8136c1bab0d995f9996bcfd5d2102c035646f1662ca0fa608b10
SHA512a529367953c629872cbc5853df0b57d859eeb949898d71aa87f0b2fa588c5898c46f5c526da5c45fd77cd8d9d070030d3047981f798f525b2a18d63442ec796a
-
Filesize
73KB
MD5433b782b4f3d50a2287d7b38e2080455
SHA11bebb58a27a8acc9f596b86386d9917bbf838f72
SHA256a87fcb60fc681927cc262e3abf00cacd24e13b616a23c821adf9f88e0f98c588
SHA5127fab3f9392f3978f49eab76e1bc56622d428305a73bf7e5f6cdfb893289bb42f55922c8e0a4204f97a368f7bb3e80a8719cf9d3361eaa093836f1a99c3b5f0f1
-
Filesize
18KB
MD528fd612c3927525b1a09bd4c14741400
SHA17e6e74c12635d07fc136670d665d1a14c6b7d2ab
SHA256bb7b45cff2165fe1c932760eb6d0e4155f67693224e6a01b64c5a3136788e83d
SHA5128cc2f0cd17de5e1781f695fd5b597d4453d0f8dc54ff84813532cb34944131b0844cc1e17c46705407fe2eea0986e250f01c8a3cf602ff7a51d825825fc3ccee
-
Filesize
27KB
MD5e5f0321daacf32c3523fd54584800a78
SHA10d69cfa70764045fc6a2dd123c24ab46e82c528d
SHA25675325dd8a8b86bec7c9b38393bc8c1be19851548e651f2f32ea36e76029c38fa
SHA512ac47122653cc2da16dfe1ae044f50738d40590ea352c76ff31b9997a8920baa098669436fec2f4d6e5bfdd185fcb971bb52eb41e950ff59a97b11c9ccf659d55
-
Filesize
18KB
MD56b20ef7f421b405de2543d8e34649c30
SHA10a714b21829e2e30f8d1a18e0b6d7f3d41567a65
SHA2567eb8d2cd343524f77da1ad5f1df09e232cfeca881d59d9e9aa357b9dd90c8a37
SHA512f524c9cfd6d4d7c1255e0401651a9800900dc2d963db38a116fc59b5a6720a818861b787bf8556a54c5961907db8c595261272e9ec248d1dded4fe70c7333360
-
Filesize
22KB
MD5d713118ccbb8c1d9bdce0ef9a87fe7ba
SHA12b256ab8d6813abe396352fbfe5ff483e8affcf8
SHA256c7b879fe335b21c7349005b37b019a11f70b15ab654c899bd2d9ed9fa88712ed
SHA512adcdd4c8161a8d9c0647acd57e37b02872d1e4a9eaacd2b06a27ab6be666333ef8a8db2d265b4a1808796dd44dfc6bfe2dbbddf52ad474cfd314aa9729cf2a83
-
Filesize
140KB
MD51514002cb7cf9896ca2a9c8bdb47338b
SHA13bb97c0552f9ab3184ef943c1816be7c217175d7
SHA256173df6d8fe575507799058c084d275bd43fb1d3f4ee42c5cfab8b308bb8a3e5c
SHA5120294194be71663b9e4a1a997f4743a503462b1638f53f5ba9c0732d6465943f84351cc6880eff2c61b65b28e6dac6c2a1ddae0635765775fb73b9f3080f17903
-
Filesize
108KB
MD5184c8398c0241351b8aea01ebf0d411c
SHA14527f869482a87aa50ade26ac357f56721b66559
SHA2564925a93cabb2e134b04dbc54d2a54b920f26222334cdfd42e12c215fd5933597
SHA5128b2574e9e5d14953888344871d716b27d8ccc672ae0c679a7355899f2a624d37c84d0eccb3c5b16959275c89646c5e3480633f88b3ebcbded96b859ac439f8af
-
Filesize
19KB
MD5306aea40fe5f202ffcd24f79a8c1df49
SHA14fa737f83131aa3e71b5f0dbc2a72f59287e8f74
SHA256d38a36e64e56b6e9fd1f34421e19ecca12c56943c6dbe75b3ca605cadd113882
SHA512429f6ca78fbbf4c198dffbfb2bec0322dc7cd78b52d634297d6ce93a29eb6742b770d1debcb707038ebf4e0be5a1fa9fce2517d337386fcfd3cb003ecae3841e
-
Filesize
20KB
MD5d59b818cf2124316e1b9b82001304782
SHA12ef7729b3f7a25b546bbd26bfa59c9708ebe9f72
SHA256e856405bdb63a9e30f0b56b98b8b5d381bc9668942f51b4a057310aa09ab9168
SHA5125c8ba270b8f65736e0b4e3cdf6db0a2e36df1f4b9f14f08b9528efa0ed9a804a8f0a58bf3a65fa6b03a722b9691aa0f21996713cb96c0cebb9c3c1bb0491173b
-
Filesize
27KB
MD57aa9af102242b0e3a2df8a6e794e6f24
SHA1760e0f56984493d569b7545a203d785b3130b8c1
SHA2567146ee29e8c6ad2add265ae632e20c92718a5a51165f7e2d10d23cb683e15680
SHA512f3f6d5a204af21695edbc51bfeee6351339b871b43a3950286050a46f5a30321ddf2e73e48b6ecd4063e45956fd10647f6ea977694a950e9a96bcc217aa501c1
-
Filesize
242KB
MD596f8c7d432a7f766693e26764189529b
SHA138a910e16ef99820133c3d51262f82effc77d078
SHA2560e38a56f515d2ea5afabbe60148386b6740dc8bf141161263f64e21e89f4bc95
SHA512dbc90325e5d837b32328bc45ac4539220ab8ea04882775ad64c9cfaf7e5cdb9375db83e77acdcb6bf2edf6708aaf3be291c5bd1276115f0d799c3862472aed60
-
Filesize
41KB
MD593b54ae5ab538c423aa42e0ad9f21369
SHA154217b5a2fb10b7f786837c3a9dca98ddc03a07c
SHA256c748e1761528e54cb6637e46a50c39a1bb5e8f951ae19ebe64c3f424eb774181
SHA5123bcd7772251c0c59e76f345c218e972cb07dcf14dedc3f07ab90d658470770883d41ae0671bc87796097b6fcfa12476202d1d0633c07ef4fd0d338ac00d214ac
-
Filesize
290KB
MD5c59d83ce3b43dd07757910b4c1694b40
SHA17671aad5be051ef18ecd733c36ad58edb8a98297
SHA256e99fd45109ffdf65e427a60c6846aa7adc6da833a97273ae99c7f6dcade0f7ca
SHA512aac5b5c549f47ffbafac11a8f132d5202e9edf4389c4a4d25b569f7031c898e5aa490d8a56d4b4db5644ffc0d54d3e76492eec775b5ce3352a60c31b949570af
-
Filesize
64KB
MD53ddc009c633979403c45c6b57697deb1
SHA1dea8ef6c69352d4232752179681acb720e908b3e
SHA256976ac895f7453f4ab8437f2910fe130fd32fe91164dd306b6c58607e64a3c7f3
SHA5127a0d2ac25e44e5209832fbaecca4c2a26d93098200c4d192d9076bb21fe6b971fcaf5f3596f6926f1ed398e62ebf35c61c48c4ab389a0e00e39a49452dd4c76a
-
Filesize
2.2MB
MD51fe2d424fef1144cb420d1bb74e68211
SHA1a0a06c54b0b0f528293a378d87dca607dd5c5a61
SHA256643b43b466c82f7c4d81017d33a2eceddd27c950012d54b3574c717192da89b3
SHA5127b888120d899c9b933fe498f6808ab3dbe863de232e0876ceddd785057a3ca2316167680f135849ee829f8feddc9f8a90c7f0381ae2ea1199bd6a00b9fefcd2b
-
Filesize
23KB
MD57c50fa817cb54f049c2fb3c974a4694e
SHA1517967e404058f6854f602296f92e8deec4954f5
SHA2561ccb7b601e475369727b1bce89cda0551f1af9b6f06553224849e71c2169e09c
SHA51233dd839642bfde741d12cb8d7706cde54193a4983b9de25cb3d30f2c82a6854a96f475cca7d1c0da56a6d523588b2a81e4b2add02bc7ae8b822e8ffab4b55ebc
-
Filesize
441KB
MD5c8a634aaf70c64667d529632bab529ed
SHA1e31dc0dd50ab6ba2110ce65de5cceaed6ce52966
SHA25686eea1826d2f1c6740af4569884c25b0773c5f29c5008da01883434dd1a74045
SHA512e371bc2ce5c3d57cb013512b5628c00c1d5867cf792f2fbd2223d6c1b6ce9adfbd8d9e73fc11a52fd5ed2de3bdc145770b897f1be3c7a0c4d4ef2c56611772ad
-
Filesize
40KB
MD54029f5f83160e495ece0c84ef6fe7420
SHA1ad0b784e16343c3a25c3c7e4eb2dde7331a1f9fa
SHA256bde128af8478d5c60917fd637bd9d62cccffd1fb2e594779595f30abcc6b6b21
SHA512303fc5145c964bc2f0c4060a86d57ccce21cb09a2c13fb8559fef44917355c06e43f9091cc792757c8ffb588d8b6b069dfb26d6ab2e280156a016e22808804b2
-
Filesize
87KB
MD581cddd84c0faeb97dfb495ddfea1764d
SHA165c4da96f72f73489623e1d3c2ce32ec2e804147
SHA256d1c0c7eaf223cab955a8d29e019566028227b7d8b74fc8aa8fe65fa782e02738
SHA512a5fe3fe49aae367e2ed6c9c740db8b322bf5a781d5f0c23637fdde950502e4aaea7fc5e7d55315896cd382222bb42043918856d8a2325571ff2a2f7dbbcd7641
-
Filesize
257KB
MD5ff4568edc9fce6309a363f53e8265850
SHA174f421d5b757f9e5a9526ba390b59f4a871ce3da
SHA2566788f84fe5b1c321575c35da92f6ba775dea7937fcad83409119dbf8ba2d8aa0
SHA512a7e13a77e3bffb697fdb019eccd9a8d629659c875e8a47203b57e886ae241f96a6a97600404d4fbf9eb010a1a31d6fe282a9c6685a970af5a13960fb350d74fe
-
Filesize
3KB
MD5c79bd4b94b0b83d4a3e1588614524a95
SHA126a2ac217abd39a15773d2e3d2a6aa2ac7d45369
SHA256d6ed263761188a215ce302b69fe0b73b6dc796f5935206c56d2f9e1694c00635
SHA512b0e4926b49ec76fc0fb66021598f836e34b61a7540769346b9a0689ca7dc11bb65309ced8444f7a9d80727858720387b99b1eb49d6819b07f257acbd7f3ef0ea
-
Filesize
4KB
MD5542e0102aa5dc40e3cb21c84ae94d053
SHA1e48cc5b7c06513b86180c52270e85dd08e74c86a
SHA25656c2e8781f54a083aa5a3b19b8e018ab96917e0bfe79be8593161f2f2954276c
SHA51274d2394514e8f13244517c225c2e4dc17f2a9f796b437d7c7f7ac8635654f4677a490e8879a1e52aa8ffe0b769124dfe173db3ae97f9ccb369fd67e7d12eaf27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_59F1658D90E38DA89AB56C23C0E7D055
Filesize1KB
MD52eb400330e15f846c7b7d7c85a92f952
SHA1a24d437fa19557732902b10995b71cd296172678
SHA2565087e298b3ea788618236d025bd17b07387b275ce5bbfe9ac816dc308638eef2
SHA512a0eac9529cf4fff40a6478a2e81bc7ffb968efb384c4e6d5631cfdccb54a0901901eb07b03302eaa09d9a5b3962c081a89c5c3566e9f77beeb4e1d9fb018dacc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize1KB
MD52199d70f16238c8dc4a86520c0dc7beb
SHA1b98c96affa7fecc4baac596de8e1c44fe586388b
SHA256194c311e5545ee3385718be6d335ae118bc5eb9b4940c3299852a8a30355f135
SHA5126394897ed5b8b2f25af114ff0c313e311b34d0acb0d77f42f42192b21a44b36b237c7c7755ee6e787771b3c508f12b04354df1d79326640b675c8da9c706256a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_59F1658D90E38DA89AB56C23C0E7D055
Filesize536B
MD5276ecbe3d4c5392e22bad8b51595fab3
SHA1e1ad3d750df22d30b9f4ec11e2e60ec93321a6dc
SHA25680813f701818abdc01faf29b6335f54c4a51c372eee94ed5e79fe9ac70c9d278
SHA512986216b6e3778b8c5c52087e53151500582e07e2fe286df9f1c29ff34e6e61a0bdbbfa38c5f744531103d81e3fcd95b273a34871887e6c6eaed965e75b26589b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Filesize536B
MD5200f61ead0b37a9093549365d967afce
SHA1b44b280754daa9a4abe8fa2ec8a0231a8c9e08b4
SHA256a9340895183123fa5bc54cc7d9f2fae8af80153616e26e2b1b06cb635ff2a0fb
SHA5121d2ebe32a3ff277d25a027aeb2f9c8e57f0ab0d37e4106a0138e23fcc8e6e1161a25f1e4f36a1f629dfa45d9fc602267deffbaf17b2686653728de6c836de21b
-
Filesize
932B
MD5018405ed047112161c94944d592cd8c6
SHA1a8de3d4829f59eb0c1762204fdd73b545e8f0b6b
SHA256ba407b1a2bb0d7260287f21ace7fc5bdca5ed36e8177934a1ed13d7a54573a5b
SHA512829d5c59821fc803187a86967ea7459b01e1a9341f649d283863882a52830e10f2665487dfa1877985db1c3da0a8e9a09a61adade253ec568595da5ed7126a2e
-
C:\Users\Admin\AppData\Local\NordVPN\NordVPN.exe_Path_zwlpwkcl0afjdoe5ehsuengnewqjgrv0\7.17.5.0\ge1h2g4n.newcfg
Filesize13KB
MD5a69b1d209d8702c5300bb0fdd7a37811
SHA17873c448e7251edf35176ed01d14409911fc681d
SHA2564c2fdcbd42a868db5a3ef7a6345e4531fcafe698989bb88bf997bbbd75dffcc5
SHA512e1e827ef7cce5201d117bc7dcb01fbfe295771dcf6ba1ba4eea72da77cb0ea68293decd2d513c22513d54aa98c589cc896afed1646e80a69703f9a9b0e52007e
-
C:\Users\Admin\AppData\Local\NordVPN\NordVPN.exe_Path_zwlpwkcl0afjdoe5ehsuengnewqjgrv0\7.17.5.0\user.config
Filesize1KB
MD58a58d68a739fd872abd317cdf5502476
SHA12a7090395db84302905d1d158942a95c230868ad
SHA2562c976d2e0fa7def139e523581c430e1de864cb6877b656c656eef09b0ef23fba
SHA512d3d31d56faa4bfd029afe0f0af16f985744ec1f07e6d83e9d135f6c0ac27fce141c7e7e1e3acbc6c9454e1c5472b202e27f4a7f118cf3e7099579b6cc40ef732
-
C:\Users\Admin\AppData\Local\NordVPN\NordVPN.exe_Path_zwlpwkcl0afjdoe5ehsuengnewqjgrv0\7.17.5.0\user.config
Filesize13KB
MD5cb6989558201f4ab339aff43a578f20c
SHA1144275fa04946d0ec446b4069a3b41b5c3f9f374
SHA256465b49f853981ede7339246db0cf1178fd43e15bdfc8c373dc98c142d20d9150
SHA5128e837c43548cf42571560f9c7de8eb1b017df755f1b23c07f5d6a81e43bdab946836023a9b8d5a07767ccc2f774fb549e8608396558b37c2072b54d04561098a
-
C:\Users\Admin\AppData\Local\NordVPN\NordVPN.exe_Path_zwlpwkcl0afjdoe5ehsuengnewqjgrv0\7.17.5.0\zkja00l3.newcfg
Filesize13KB
MD56b03ed9b614e738f56df70f822f031d3
SHA1e916836779b3e00c63bd23db8fda194f5931845b
SHA2560003f441a1dcb2e41c7887f0d63666d91a4a00f43103880507ca237f12a265f7
SHA512f2e7d157a5b008771f30761ec1788db74b08494b974bb9868f2894c012c1b917519894619b9549ec02efdbf82ffdfaf28ce556a1a41ef8f231448ffb7236d9f4
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5e0318545925262ee25623937bc30f43f
SHA1dcd7b4f9513e205d046fcc3c42bce17f043851d4
SHA2562233a96a9ee22402cbbc28f09a606e9856e3a5e3a9b5aa005a773481bd520b4e
SHA5125a34b9e05e09e65775775f054f47e1f25b2246cffa6e18dc29521957512cbd415c184296664ce4ee48f3fc0be50ce4647bb6a1a5297214c8db7a6f912306b313
-
Filesize
226KB
MD59843720888af3039c7656525238a2c50
SHA17f34f3a5a44812613833478cdd4d51ad1507e8b3
SHA2569d1bc61dc0ac1d00ab84ef24eea368eb9dc4b6ae540bfb7462a1d9b128a8c5b2
SHA512129acbdbc09cbf636cadc422f60f4b3bb2847c6774fa79bf56d3e1b2acc38ec7965a1d8883cff50b528ba8cbfa059d1b1a559ac08cf8b4f91e13bd6d678a39ca
-
Filesize
302KB
MD538b6a65f24e8b852a735b2bed6275290
SHA1dc584f69d35ba25d2366de6b6749aee16e632bc9
SHA2567bee327ae53dabda3d266fc3000348625ced53b93c7fc52931953c113c8e917b
SHA5127835b736b665c9c58030c8c848af00458d01bfb459644ce144bbde91ae537b727b0c7e853e0b40ec7de15bcb1608d85d5961a4251a1cce1d9cc542aaaf86ce94
-
Filesize
128KB
MD5be3bee7faef581adadd14ede4bd4938a
SHA1022f9c9b7f5deb8041ac3581447d9c52e02cac86
SHA25682951ea3c62b7724e5c2e692c1e138cc93b0bf523ebf7ba1e71080093139cd1a
SHA512d502ad5f594f9644aa1914195af0856cae28c06efe1e307f06084f766fe3c94b63434ca77cf94f3b9462dbc9b5ea67618a91cb1613189cbec6e1209210010ecd
-
Filesize
220KB
MD54f2193ca49c45d02272e0b287a00be40
SHA1a80ef2ec95ce8cafcc5c65e204495784beed034e
SHA2566d372c6006aee8639b070ea4307017dc9d9b6a0e79a33577dad7c5265db6060f
SHA512bd09dca265bff84fb40c883d4f930007d30639d2ffdd69ec8d844204b1a34c927f24a6f4854011e174ac403094d9d70a3e46ae3cc36b4186f6d150972584a6d7
-
Filesize
3KB
MD5cbfd83998c04cd224ce15df7f5bd9b5b
SHA16f886230938e7aea1bf07b4fb9e5c73edb750183
SHA2563bc11976e842256e1120761f23e4618c8d719376aa26da7be28fa6b18e2d1ba6
SHA5126f9e0009216dfb0f52de51f3b84146e831785a816f802f6b69993faa3545e4790cea2733d9947d4e413c2d9490ceabe15e911fd99d2af9ba5aa07e214778b1cd
-
Filesize
1.4MB
MD53ba872bbc0ba3764b3fe56c60ce74f68
SHA16bb97a4bec6e9284a8280ec89ba2ad2ad0865106
SHA256d78234b032d17f9299a5c62cec497e3ddbe3d6a7f85448bdde7299901c1ddba9
SHA512248c17819f4f61c3f42642c8201eb42c090896b4f4198d47a8cab442222676d8fa4a9e81a221ef3d51ffa18e8c717beff22abe8738cfcb21b6c4145b74bb7d25
-
Filesize
1.5MB
MD5b78024ba2bd6dad000a6f873cc2edafa
SHA1827c3f39988708a3a4c38b384d111e7ac7a26cef
SHA256ad10ee45212948f831a44f452475a8c72ab030a8b96e200b8b33604ab448a260
SHA512ca7be09c79c043285c7c4d4dc45b5474b507d56cdd3caf361d91d7ed33c707d01cf406c93563ead3ab892ee28bd10adb5cecab6ffb835f48e2f7ed73a9c16f3a
-
Filesize
85KB
MD53b792e5b10238db7a9da024dd8703491
SHA10fd524f89c9e75606c5ebca12b6996c8dd2b5c3b
SHA256cdfcaf6333e6d39322ca8e200a58309b82c80b662c2752f28cc35a68853b09bf
SHA5124135f17d9ef3e611443b80b828515a09f5d7c79f6d2cd2253852f94cad77cd79fe437dbebdb6bcdf2bbdd153bb8e85ea364678a7062749f812296aabfbb5e3bb
-
Filesize
170KB
MD50f714846f9ae8a60f5cdb4811377b23f
SHA180033367772bac128fefa8707ad64b4b27cf0c34
SHA25698d547efb2bb65c32cc278beed99c4c9ce83e63f0032ad327fbc5241cdbaab90
SHA5125149814592ffd2f756f60dbfc8bf10dc7c91e3c8b4a8d1c881dc0c3b2ecc6ffcf98fbd6b7e0cbf2d85d02e314b8ccf8f6d1646198553365c5560fb267bacddf7
-
Filesize
43KB
MD586987d004c2d3caad96fefa875021497
SHA145e6f69b0825bf822ace2b69b1cc55bc9c62d191
SHA25612c9c7434311fb10fbc7269713ff8d7daaf722cc8038a397694d916e785a3d95
SHA5124f2c0d55b3a8ef1729cf6f3049539ba7744e28654873995f2aecaaccb3f72b84b9fc191c54370c6b58cc5c34829d8a5c31769b1fb3a0d9b724fdd4b71101b9ca
-
Filesize
2.4MB
MD5d2f4a4c78b3965a39995d232486a23e5
SHA19e962c8d5808ddaf8c5e48119f56df41296a8a52
SHA25670b3e3c1f4a009a73b420839df92173d99c5c3e3e868b95fa54e0d3a07637aab
SHA512f2d65e9e1ded28c14cfcf8b917157fa9bb6c89c8af1b05f0d9e625253ec57571dbf4bfd4a8b69103e9c348f84dbbd4cd55ca2c1999fb637f305f29b56e8543ca
-
Filesize
1.8MB
MD50286596751652c416c476554d0ab4f92
SHA148a10cf5d812fd13c25a485fc92efd987aed723c
SHA2564f78c345d59270d7573cb16ac55db672776ff26fe5ff605612a641e220806353
SHA5122bc906cf3eb63d7ea3410f4b066a25bf58b68b579f8cf72e7cabf1d9a1f4b68515b7a413601cfb9cc2258ba4aa5ed296b1e27dc613792609232b75e32ddafda2
-
Filesize
2.3MB
MD5695f1e51c617f2c87b9a6bbe934c452b
SHA15d200020fd9c59bb4345468b7c1e1f126c9b7385
SHA256c38b3d60c1e1805679a14aa0d37992268e616984b69bf1cce16d626b174b3494
SHA512ccf93da4eaf69f2b2ff7fdbedeb219eb24425b28b594372381a2110a96f48ad1f9915293d3e4a171a2f0b85b556a763a9a423fec72257364581ca709c72f21ad
-
Filesize
2.4MB
MD5f9ee81092e74e1d5481876e1dfab8003
SHA1d1be1087630f2b47ad08b7467ef5404772394de8
SHA2568c0c9516d30c45fa91bec05c7015385c48df591b7fac958923625e725fae3953
SHA512eb266c63a5d897082d77ef97b462f0133cffa9b26ef7881301c9e14d6b382440f4eaa1046510a5ae30ce477ddbbb0666a2a01a25a69eb2382933efcbdb35646d
-
Filesize
85KB
MD529d9017f014d066eb8e62c736b3fa8f2
SHA1b2a83e6194cc5e83c9f5284a22dec0ff6feba7a6
SHA256564f9a7a97a9136a7a0c18b453b8000bd1badbaaff5c370232158d0277bcdebe
SHA512069bd67c5ef0d2b9e4afe6dfb573a0b87ddcdba9f16ca793723f28063570ca84dcecc8d36ead85ae11bed13cf220ecb883fa407fa21cdff72960d31bbf2ff6d4
-
Filesize
169KB
MD57998a1a52eedde342de34b4147006419
SHA18fad49145668b4387d233e296b6f57342c7a1a55
SHA25648003909f632c53e9ab7edaf8660b6a12070325d733c7c14f0e3c2d72487a8fc
SHA5125d217922dfeecae213dfa950c3bdd402c27fc8ffec0de31ec6a457811c45a230e0a940d2dd8736be192785dfb77cfeba7bb6bda74ff0050a9ee1b05c3c4486b4
-
Filesize
40KB
MD5b18bd486c5718397bc65d77a16ce2593
SHA158fe73e27c5c04e6915c5358f698f7fe8c2b5af8
SHA2560bbf32b0553ca1292602e8c2c0458e075fdee2c8b6ef8ea81e924a86bc065f3c
SHA512f4ffa1c8983914c41657fecc11c9324caa5899ad875b9687da8ffcf79ab189f19d6f926e16f09f240de9e6b22e26691fae785ed95657af310de5bf6c58ce8e0e
-
Filesize
8.0MB
MD50bace316d1a7d8335b930c3783ea2ddf
SHA1430dce4f5490226119920ab39bb9ab9cc0b1fa67
SHA25600e271e3de3ac4cbd42b050f30bec11a95bd41bdba0e3754ae4d93d4558d37ba
SHA512a1ab69db5ed567818d6384858bc62b23a73bec0402ae402e7c34e1a7ed1b0186a4d0440a84be1c45a0c91f05961e8e491c9de94207b1505758fcf93c027ccdea
-
Filesize
1.3MB
MD5553cbbddc8bdf419ce967c8d38802f80
SHA12befd7c7a234a195183ef715df01acc0cf8fe407
SHA2565500112089b518a13e122999ece258fb008bde7378ae0df81d32403990f3a9c3
SHA512e44220e6329974089e6adf14b02e89570cc5122d933a4686ee4e1fbe24a15cd7bd9eb89b967a81b9fa7510205aabe8957b2478074f7783abaaa24088030bc5d2
-
Filesize
778KB
MD59617865d97797221e580ea67c748d4a8
SHA101a6cb7f21e715ab59c7459e90f17ac2441ead6a
SHA25626cf30cf7be8e0b2d9ca4493e373a99cbede5e65a19a5377e2a39468cc064539
SHA5122a74af617462bcaadf56dc14c4520a712ce787b453d9e4f77dfc8273b8ff0efa891bfcb3736335e2b69d93e775763629f5219c725075461ed5a098120d9cd817
-
Filesize
3.1MB
MD529ca787f3a0d83846b7318d02fccb583
SHA1b3688c01bef0e9f1fe62dc831926df3ca92b3778
SHA256746b972e21acb59e4086b5b25fe53ef2cddcecfa94dd56ad68c8e5bab9960c3c
SHA512a6c21bf5590dc91a5d9bc729d9c04c20b54341d3270efd2fb7d2b548d7dc7b23a1a351147a07dfd569e901a608cb44533304de10725cb02fec781cada80b8e3b
-
Filesize
577KB
MD54bd55ca0f7525a3a7327d32abca3b18d
SHA125affe921447e9aef2078d4548d2ee26e845c9a9
SHA25604680df5db9ede48d30d8fda697c625273addef458b0e42124741a3b857f341e
SHA5124fc0f220af8b0bd00630fb45da0ab5599152e6e5e38e12e22c6bc32613e2ba595f90d79e141cdc3c33703654bcd820254d6d06fe3fe6a61ba0aaf3ab0c80dadc
-
Filesize
1.5MB
MD5e6c668ed97d74d0cec3bfff6b513ecaf
SHA139c4bbe76a70ce084b04948b659268ec60a53e59
SHA25626956c82bd60d4135e0c246df17f3c5fdadead83b0316ef132d4ece74b4563e5
SHA5125442c49ee9b3c552e5063d92fe6071e27d3e7886860580cfa9e117c7e4d15ed287848280ee74b74167fcca07decd083a2c332e682eb6b96eed2da3f397d18c63
-
Filesize
18KB
MD5ac6d71791145967ba29b9bef205ef9e0
SHA102f296e9372af98b524e852f364974a3116cb57b
SHA256d9c5325175db2e57cf27642072d751f55da2f0c332d25195a2be6f5acbc7a8d2
SHA512ba78079a7a3e931458f00b7989f5f88be4c746b5f83b77ca9b236f97b362ff476d76c1721a458bd2ff77940c221d46136bcca319f07240f7773f35c09dcae02f
-
Filesize
7KB
MD50d719e9779f64ab6499ccf7452f99c9b
SHA18e170acbbb222588a05d4b22105ce056c342859a
SHA256fa56f77404e9fa7723d95a493f206f1bfd2644d83af984b92a45c94a2ea4f7e5
SHA5126904c34f93a3fc4276f113faffd14084a50e136a7bb5e31129c3bf030fe2b6d1b5c2f919eafa2e322f01db57a5376a2c2fca37f402a8e51f7161c5d016565050
-
Filesize
381KB
MD5e2b1df34e19a3ce763747b12ab33fdd2
SHA1e9cc67780be7e148950870ee4a812349b6255f39
SHA25614daaf1090e11ab1abb01c0bd48d5435c617da9bb5a4dd019df8a5813ed3b3e8
SHA512a0301667b341a5806f7a6eccde40c22f48749d7002ea9d6a656df36088a6c5398466c259a5d1e6a8457f1468f56a220b1490f34c25859172cf8cf5e0d263eff0
-
Filesize
545KB
MD54e584a28104d05ec8da5edff3d9a2e8f
SHA1283e2f72649b69d75b1943bbb30f516030eacf0b
SHA2563b3c0a49048f5c9438757199bc57238f5624ecdc1c54756d71424a6479fc977c
SHA512c34625e4c59525b5dd3484b01273f3f2f05cd6e40ce9bc2e8310bbbb83cc0cffb78601218fbf43e8395ca3d7912a81cdd99499700d816f7b6a6c92a075b599a9
-
Filesize
10KB
MD5ae5e7a3609077ef8ef287a90fa34599e
SHA10046cf86bb16e8aa8f036684a79e8ee2e47a6e96
SHA25650315c54f0f5727df5b00047757ab038d9946e2859deeacfa8d5d9d050b3fd8a
SHA51208efcec283a564a4956c7583209b403d6727e1cec08a4ac5241e897f40bbbb6b3f6bf3d4a08e2d2df7ac89826168367bb56a39dd1ad5d0cfcf3ce72760d5f0c0
-
Filesize
48KB
MD5adbefa4c0ad655eae60fd5b58e6e7be4
SHA1c18fcab0dbaaf6407441a596411f33c454d8a345
SHA256b64ae9f92a2542ec8ce063f81ba96894076f2d5eba37e25c47018d0db38ef503
SHA512acb5498c70cc57e9b5667e1115ef1dcd7b345f619cf7a8734117f1f85dd2091787a4f9be3af8c306ba0b897b04644c936f242ef65d7b397a1a60cfa6a315ca66
-
Filesize
782B
MD54ee28ea0e8c6d8bee2db4e4521123b53
SHA10c42741f31bc5c915fc0d4a2908ee43f372d06bd
SHA256fb1aa055dff33e58012f7c6b9d85eaf7234ecdce31e05f7caadebb76ee4fadad
SHA512f95e1a3e4f5e32bda6d1f9d30c6d750e61fee372f5eea5519b83bfaffe6008ac508547306957b4de3bf5b43bbd2f684f1b8042312eebbc6ea3614c4b13cbbe8c
-
Filesize
804B
MD58120a2a5bbe15b94b00ec360f3b58674
SHA1a52a5eec1c4b8400f6649bfdd55e8c39f0f53c12
SHA256669fce0c7d292a008fd26854c1aa1dd3a7af9c255f0091af809c6eb21f6f70d6
SHA51287d7ac253c7deb10c03ecd8f7a239dab778f4da1fc91e64c6960299e756e10e7bd52c6420e54311b7cb34a0689f99edac8f4995c33e484ba9f90cd7ea84e89dd