013a8235cb3126ea004c16a48671cb3045f81031864f2af56bb9e50a6737ea28

Analysis

max time kernel
1798s
max time network
1799s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

pia-windows-x64-3.5.7-08120.exe
Size

21.2MB
MD5

c5a4dad9025bd2196874b395db2093e7
SHA1

f38ac163e2064f249190a2cf7b3e50e1c66beef8
SHA256

013a8235cb3126ea004c16a48671cb3045f81031864f2af56bb9e50a6737ea28
SHA512

cd6f1d26b27629b9e1711374483f4b8b491fe993e8e68b513bc28678f28a14a18d71a99c29350e5c5cafd9edc10a0076c520157a3e52a54d601c75371bdce350
SSDEEP

393216:4FHhFZe5GUYb01APo8ao8mhQw1jfCmczH5iW1LsLTn5zw0kCROwCeB0VereKyAm:shq5dUphDj6TxLmnOlQBVBPerx

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SET3FF7.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET3FF7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap-pia-0901.sys	DrvInst.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\netmlx5.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\msdri.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\wceisvista.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_4c9c04020589fe8d\oemvista.PNF	pia-windows-x64-3.5.7-08120.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4dc6ecf1-7a57-0b4e-9700-14a2a3c80a1e}\wintun.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cff9fcda-fcfb-c14e-a749-bf5f77a1f038}\tap-pia-0901.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\b57nd60a.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_def3401515466414\wintun.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4dc6ecf1-7a57-0b4e-9700-14a2a3c80a1e}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\nete1g3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{cff9fcda-fcfb-c14e-a749-bf5f77a1f038}\SET3E81.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{4dc6ecf1-7a57-0b4e-9700-14a2a3c80a1e}\SET8677.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\msux64w10.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cff9fcda-fcfb-c14e-a749-bf5f77a1f038}\tap-pia-0901.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{4dc6ecf1-7a57-0b4e-9700-14a2a3c80a1e}\SET8678.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\netbc64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{4dc6ecf1-7a57-0b4e-9700-14a2a3c80a1e}\SET8676.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4dc6ecf1-7a57-0b4e-9700-14a2a3c80a1e}\wintun.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4dc6ecf1-7a57-0b4e-9700-14a2a3c80a1e}\SET8677.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_4c9c04020589fe8d\tap-pia-0901.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\netvwifimp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{4dc6ecf1-7a57-0b4e-9700-14a2a3c80a1e}\SET8676.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_4c9c04020589fe8d\oemvista.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cff9fcda-fcfb-c14e-a749-bf5f77a1f038}\SET3E80.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{cff9fcda-fcfb-c14e-a749-bf5f77a1f038}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_9a5b429abc465278\wnetvsc.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Private Internet Access\imageformats\qsvg.dll	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Private\AbstractCheckable.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Slider.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Base\ComboBoxStyle.qmlc	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Desktop\CheckBoxStyle.qmlc	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Fusion\CheckIndicator.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Dialogs\DefaultColorDialog.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\api-ms-win-core-synch-l1-2-0.dll	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Desktop\ComboBoxStyle.qmlc	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Desktop\ToolButtonStyle.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls.2\PageIndicator.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\ucrtbase.dll	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Fusion\ComboBox.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Material\TextArea.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Shapes\plugins.qmltypes	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\Qt5Svg.dll	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtGraphicalEffects\ThresholdMask.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtGraphicalEffects\ZoomBlur.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Private\TabBar.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Private\StackViewSlideDelegate.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\Private\TextSingleton.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Tab.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Imagine\CheckBox.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Universal\ComboBox.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Universal\PageIndicator.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Base\CircularButtonStyle.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Private\BasicTableView.qmlc	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\StackView.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Fusion\VerticalHeaderView.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Material\StackView.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\api-ms-win-core-timezone-l1-1-0.dll	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\Private\ToolMenuButton.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Desktop\ScrollViewStyle.qmlc	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Material\ItemDelegate.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Material\MenuItem.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\TableViewColumn.qmlc	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Universal\RadioButton.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\api-ms-win-crt-locale-l1-1-0.dll	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\imageformats\qgif.dll	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\BusyIndicator.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Private\BasicButton.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Base\CircularGaugeStyle.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Desktop\RadioButtonStyle.qmlc	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Imagine\HorizontalHeaderView.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Material\SwitchDelegate.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Extras\Private\TextSingleton.qmlc	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls.2\ComboBox.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\wfp_callout\win10\PiaWfpCallout.sys	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtGraphicalEffects\private\DropShadowBase.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\Private\SourceProxy.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\ProgressBar.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Fusion\GroupBox.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Fusion\Label.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls.2\Material\Pane.qml	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\pia-ss-local.exe	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\QtQuick\Controls\ApplicationWindow.qmlc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Private\StackView.jsc	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls.2\ScrollIndicator.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\api-ms-win-core-processthreads-l1-1-1.dll	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Program Files\Private Internet Access\Qt\labs\folderlistmodel\plugins.qmltypes	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Base\CircularTickmarkLabelStyle.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Base\CommonStyleHelper.qml	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Base\images\focusframe.png	pia-windows-x64-3.5.7-08120.exe
File created	C:\Program Files\Private Internet Access\QtQuick\Controls\Styles\Base\HandleStyle.qmlc	pia-windows-x64-3.5.7-08120.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	pia-windows-x64-3.5.7-08120.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\SourceHash{0419A0C0-4CC8-459E-9BAE-F3BF5D2E2CCB}	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\Installer\e577c29.msi	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\e577c25.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7E2B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7D9D.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\Installer\e577c25.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI7CE1.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 3 IoCs

pid	Process
1676	pia-service.exe
632	pia-client.exe
4468	pia-wgservice.exe

Loads dropped DLL 63 IoCs

pid	Process
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
1048	MsiExec.exe
1048	MsiExec.exe
1676	pia-service.exe
632	pia-client.exe
632	pia-client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	pia-windows-x64-3.5.7-08120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a1a8d825d9cc14480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a1a8d8250000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900a1a8d825000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da1a8d825000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000a1a8d82500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	pia-windows-x64-3.5.7-08120.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	pia-windows-x64-3.5.7-08120.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	pia-service.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	pia-service.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = ac0e0000fb9167f7c7c6da01	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	pia-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C0A91408CC4E954B9EA3FFBD5E2C2BC	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\SourceList\PackageName = "pia-wintun.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\SourceList\Net\1 = "C:\\Program Files\\Private Internet Access\\wintun\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piavpn\URL Protocol	pia-windows-x64-3.5.7-08120.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piavpn\DefaultIcon\ = "\"C:\\Program Files\\Private Internet Access\\pia-client.exe\",-1"	pia-windows-x64-3.5.7-08120.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\0C0A91408CC4E954B9EA3FFBD5E2C2BC\WintunFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\PackageCode = "F1EE97BAB9B672348A90AEE44A70B2E3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piavpn	pia-windows-x64-3.5.7-08120.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piavpn\shell\open	pia-windows-x64-3.5.7-08120.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4409151FA8CA4DD4F99AFC3506C63DD3	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piavpn\ = "Private Internet Access"	pia-windows-x64-3.5.7-08120.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piavpn\DefaultIcon	pia-windows-x64-3.5.7-08120.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piavpn\shell	pia-windows-x64-3.5.7-08120.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4409151FA8CA4DD4F99AFC3506C63DD3\0C0A91408CC4E954B9EA3FFBD5E2C2BC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\SourceList\LastUsedSource = "n;1;C:\\Program Files\\Private Internet Access\\wintun\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\ProductName = "Private Internet Access WinTUN Driver"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piavpn\shell\open\command	pia-windows-x64-3.5.7-08120.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piavpn\shell\open\command\ = "\"C:\\Program Files\\Private Internet Access\\pia-client.exe\" \"%1\""	pia-windows-x64-3.5.7-08120.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\0C0A91408CC4E954B9EA3FFBD5E2C2BC\Assignment = "1"	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 19000000010000001000000063664b080559a094d10f0a3c5f4f62900f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee404000000010000001000000091de0625abdafd32170cbb25172a846720000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	pia-service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 5c00000001000000040000000008000004000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877619000000010000001000000063664b080559a094d10f0a3c5f4f629020000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	pia-service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4	pia-service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 0f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec53726187760b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b06010505070301620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae4140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e31d000000010000001000000099949d2179811f6b30a8c99c4f6b42260300000001000000140000002796bae63f1801e277261ba0d77770028f20eee420000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	pia-service.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob = 04000000010000001000000091de0625abdafd32170cbb25172a84670300000001000000140000002796bae63f1801e277261ba0d77770028f20eee41d000000010000001000000099949d2179811f6b30a8c99c4f6b4226140000000100000014000000d2c4b0d291d44c1171b361cb3da1fedda86ad4e3620000000100000020000000c3846bf24b9e93ca64274c0ec67c1ecc5e024ffcacd2d74019350e81fe546ae409000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005200000047006f00200044006100640064007900200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000005d82adb90d5dd3c7e3524f56f787ec537261877620000000010000000404000030820400308202e8a003020102020100300d06092a864886f70d01010505003063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137303632305a170d3334303632393137303632305a3063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100de9dd7ea571849a15bebd75f4886eabeddffe4ef671cf46568b35771a05e77bbed9b49e970803d561863086fdaf2ccd03f7f0254225410d8b281d4c0753d4b7fc777c33e78ab1a03b5206b2f6a2bb1c5887ec4bb1eb0c1d845276faa3758f78726d7d82df6a917b71f72364ea6173f659892db2a6e5da2fe88e00bde7fe58d15e1ebcb3ad5e212a2132dd88eaf5f123da0080508b65ca565380445991ea3606074c541a572621b62c51f6f5f1a42be025165a8ae23186afc7803a94d7f80c3faab5afca140a4ca1916feb2c8ef5e730dee77bd9af67998bcb10767a2150ddda058c6447b0a3e62285fba41075358cf117e3874c5f8ffb569908f8474ea971baf020103a381c03081bd301d0603551d0e04160414d2c4b0d291d44c1171b361cb3da1fedda86ad4e330818d0603551d230481853081828014d2c4b0d291d44c1171b361cb3da1fedda86ad4e3a167a4653063310b30090603550406130255533121301f060355040a131854686520476f2044616464792047726f75702c20496e632e3131302f060355040b1328476f20446164647920436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100324bf3b2ca3e91fc12c6a1078c8e77a03306145c901e18f708a63d0a19f98780116e69e4961730ff3491637238eecc1c01a31d9428a431f67ac454d7f6e5315803a2ccce62db944573b5bf45c924b5d58202ad2379698db8b64dcecf4cca3323e81c88aa9d8b416e16c920e5899ecd3bda70f77e992620145425ab6e7385e69b219d0a6c820ea8f8c20cfa101e6c96ef870dc40f618badee832b95f88e92847239eb20ea83ed83cd976e08bceb4e26b6732be4d3f64cfe2671e26111744aff571a870f75482ecf516917a002126195d5d140b2104ceec4ac1043a6a59e0ad595629a0dcf8882c5320ce42b9f45e60d9f289cb1b92a5a57ad370faf1d7fdbbd9f	pia-service.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
632	pia-client.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3020	pia-windows-x64-3.5.7-08120.exe
3020	pia-windows-x64-3.5.7-08120.exe
1676	pia-service.exe
1676	pia-service.exe
3756	msiexec.exe
3756	msiexec.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	3020	pia-windows-x64-3.5.7-08120.exe
Token: SeRestorePrivilege	3020	pia-windows-x64-3.5.7-08120.exe
Token: SeIncreaseQuotaPrivilege	3020	pia-windows-x64-3.5.7-08120.exe
Token: SeImpersonatePrivilege	3020	pia-windows-x64-3.5.7-08120.exe
Token: SeAuditPrivilege	4140	svchost.exe
Token: SeSecurityPrivilege	4140	svchost.exe
Token: SeLoadDriverPrivilege	3020	pia-windows-x64-3.5.7-08120.exe
Token: SeRestorePrivilege	1564	DrvInst.exe
Token: SeBackupPrivilege	1564	DrvInst.exe
Token: SeLoadDriverPrivilege	1564	DrvInst.exe
Token: SeLoadDriverPrivilege	1564	DrvInst.exe
Token: SeLoadDriverPrivilege	1564	DrvInst.exe
Token: SeShutdownPrivilege	1676	pia-service.exe
Token: SeIncreaseQuotaPrivilege	1676	pia-service.exe
Token: SeSecurityPrivilege	3756	msiexec.exe
Token: SeCreateTokenPrivilege	1676	pia-service.exe
Token: SeAssignPrimaryTokenPrivilege	1676	pia-service.exe
Token: SeLockMemoryPrivilege	1676	pia-service.exe
Token: SeIncreaseQuotaPrivilege	1676	pia-service.exe
Token: SeMachineAccountPrivilege	1676	pia-service.exe
Token: SeTcbPrivilege	1676	pia-service.exe
Token: SeSecurityPrivilege	1676	pia-service.exe
Token: SeTakeOwnershipPrivilege	1676	pia-service.exe
Token: SeLoadDriverPrivilege	1676	pia-service.exe
Token: SeSystemProfilePrivilege	1676	pia-service.exe
Token: SeSystemtimePrivilege	1676	pia-service.exe
Token: SeProfSingleProcessPrivilege	1676	pia-service.exe
Token: SeIncBasePriorityPrivilege	1676	pia-service.exe
Token: SeCreatePagefilePrivilege	1676	pia-service.exe
Token: SeCreatePermanentPrivilege	1676	pia-service.exe
Token: SeBackupPrivilege	1676	pia-service.exe
Token: SeRestorePrivilege	1676	pia-service.exe
Token: SeShutdownPrivilege	1676	pia-service.exe
Token: SeDebugPrivilege	1676	pia-service.exe
Token: SeAuditPrivilege	1676	pia-service.exe
Token: SeSystemEnvironmentPrivilege	1676	pia-service.exe
Token: SeChangeNotifyPrivilege	1676	pia-service.exe
Token: SeRemoteShutdownPrivilege	1676	pia-service.exe
Token: SeUndockPrivilege	1676	pia-service.exe
Token: SeSyncAgentPrivilege	1676	pia-service.exe
Token: SeEnableDelegationPrivilege	1676	pia-service.exe
Token: SeManageVolumePrivilege	1676	pia-service.exe
Token: SeImpersonatePrivilege	1676	pia-service.exe
Token: SeCreateGlobalPrivilege	1676	pia-service.exe
Token: SeBackupPrivilege	3496	vssvc.exe
Token: SeRestorePrivilege	3496	vssvc.exe
Token: SeAuditPrivilege	3496	vssvc.exe
Token: SeBackupPrivilege	3756	msiexec.exe
Token: SeRestorePrivilege	3756	msiexec.exe
Token: SeRestorePrivilege	3756	msiexec.exe
Token: SeTakeOwnershipPrivilege	3756	msiexec.exe
Token: SeRestorePrivilege	3756	msiexec.exe
Token: SeTakeOwnershipPrivilege	3756	msiexec.exe
Token: SeRestorePrivilege	3756	msiexec.exe
Token: SeTakeOwnershipPrivilege	3756	msiexec.exe
Token: SeRestorePrivilege	3756	msiexec.exe
Token: SeTakeOwnershipPrivilege	3756	msiexec.exe
Token: SeBackupPrivilege	3488	srtasks.exe
Token: SeRestorePrivilege	3488	srtasks.exe
Token: SeSecurityPrivilege	3488	srtasks.exe
Token: SeTakeOwnershipPrivilege	3488	srtasks.exe
Token: SeBackupPrivilege	3488	srtasks.exe
Token: SeRestorePrivilege	3488	srtasks.exe
Token: SeSecurityPrivilege	3488	srtasks.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3020	pia-windows-x64-3.5.7-08120.exe
1676	pia-service.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
1676	pia-service.exe
632	pia-client.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1676	pia-service.exe
1676	pia-service.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
632	pia-client.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
1676	pia-service.exe
632	pia-client.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3452	4140	svchost.exe	86
PID 4140 wrote to memory of 3452	4140	svchost.exe	86
PID 4140 wrote to memory of 1564	4140	svchost.exe	87
PID 4140 wrote to memory of 1564	4140	svchost.exe	87
PID 3756 wrote to memory of 3488	3756	msiexec.exe	104
PID 3756 wrote to memory of 3488	3756	msiexec.exe	104
PID 3756 wrote to memory of 1048	3756	msiexec.exe	107
PID 3756 wrote to memory of 1048	3756	msiexec.exe	107
PID 4140 wrote to memory of 4184	4140	svchost.exe	108
PID 4140 wrote to memory of 4184	4140	svchost.exe	108
PID 1676 wrote to memory of 4468	1676	pia-service.exe	109
PID 1676 wrote to memory of 4468	1676	pia-service.exe	109

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\pia-windows-x64-3.5.7-08120.exe
"C:\Users\Admin\AppData\Local\Temp\pia-windows-x64-3.5.7-08120.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3020
- C:\Program Files\Private Internet Access\pia-client.exe
  "C:\Program Files\Private Internet Access\pia-client.exe" --clear-cache
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d8653f26-3890-7142-ad80-8c2189edda8f}\oemvista.inf" "9" "4913cc9cb" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files\private internet access\tap\win10"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3452
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap-pia-0901.ndi:9.24.2.601:tap-pia-0901," "4913cc9cb" "0000000000000148"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Suspicious use of AdjustPrivilegeToken
  PID:1564
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "C:\Windows\Temp\ebc95c55fe32344ee58c261566eedf6406ef0f0d10a47dd81ecbdb45b9119f9f\wintun.inf" "9" "4031131fb" "000000000000017C" "WinSta0\Default" "0000000000000160" "208" "C:\Windows\Temp\ebc95c55fe32344ee58c261566eedf6406ef0f0d10a47dd81ecbdb45b9119f9f"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4184

C:\Program Files\Private Internet Access\pia-service.exe
"C:\Program Files\Private Internet Access\pia-service.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files\Private Internet Access\pia-wgservice.exe
  "C:\Program Files\Private Internet Access\pia-wgservice.exe" /cleaninterface wgpia0
  2⤵
  - Executes dropped EXE
  PID:4468

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3488
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9489857A1ACE7810B2EF2CEE607653E3 E Global\MSI0000
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Loads dropped DLL
  PID:1048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e577c28.rbs

Filesize
7KB

MD5
302a75d2e8067788a6d17965645d21cb

SHA1
88508a9bf079456d73c471e2795b0d138b57d875

SHA256
27114112cdc4d73a0e241804999c528408a93505747e5a111bb33080c7cf1616

SHA512
5e0f23fa42791dc74416c824906d3e4f4446d075ef4325119806aad5a47da2cfd25ca60df99a39aa207c607b0e613ac0e0f92f02fa620dd21ea5f478ff799c95

Download Submit
C:\PROGRA~1\PRIVAT~1\tap\win10\tap-pia-0901.cat

Filesize
10KB

MD5
5c912dc8273b1fa10cb386d9c012cc1e

SHA1
9d6a69bd20d457dd54b02add95c7d2a43a4f7377

SHA256
de319c4a44f1dfa839b1bb7854e3c154e887a183b0b4e5f3f21c1f9708b6f9b2

SHA512
fa56222958edb8542979294b362205e68daa7010e68d912404f83b5ce048e00350a3d92b071fdced490ca1adde62c9878735627dc006bbe169ca0e0e01fe35e0

Download Submit
C:\Program Files\Private Internet Access\MSVCP140.dll

Filesize
552KB

MD5
acac7b54a296d0dea20ae105914d6a1f

SHA1
8b285b8534bac5e3b06bf322171c06d513246f2c

SHA256
dd64a0ce847de17e42a52ec9eed794a6347c79f4f5b37114e53eb7c967fb53fd

SHA512
14a760cbd5d0211ecfc75a38d7f6ac1ca3b7b191775ce8900759cbb16a8af318d9bf78f22374123d78510da0f34253469b16186884b721c5e1b2968d8ce2ff45

Download Submit
C:\Program Files\Private Internet Access\Qt5Core.dll

Filesize
5.7MB

MD5
bffac38e1af11804366a76d13a91ecfc

SHA1
a627516c2216c7d6df458af09819620e5e99a680

SHA256
0f1466d820d416979ab576eca864ab808ca6933cea351cb0aa769defe72603d3

SHA512
a1cf35a550e3b16ca2741c637947c4692e183b9d3e75bfb287dfcaf5ad06495db104a98a4026c486982e2ff74cfab7ff579ac61c1bec4b496d9a30d550253d66

Download Submit
C:\Program Files\Private Internet Access\Qt5Gui.dll

Filesize
6.7MB

MD5
7c9fd758d9d1ceb3cfbd3a340c21319a

SHA1
ee1d03be1975e91b9136c4552b879eefcc467984

SHA256
c79493d209840dc864626dbfd5d9527277fc66e79409614c4f2f9bfc3a8a9183

SHA512
fd32870b038febab825a812c18d011f34f746197fc4990771474352106d7a3ef73d31d42513eb46ade69785359126351c9d6766ce7111f9c3801df0da7563bc5

Download Submit
C:\Program Files\Private Internet Access\Qt5Network.dll

Filesize
1.3MB

MD5
a7ea038aa585f453506334058c2d3b57

SHA1
6024de2461f27e8f2a71b52c72a95b6f4286fee0

SHA256
432362a1163ae67a74b079b9504693fd94a328b7b5acd76730af8e6af6ad8d39

SHA512
dcea156689564fb79c8283667b3cc60fac74bb074f56a80b68a783f8e6fcb65ff4f1226dc05c49bfe47fc16bb82963b8b93c9b2e3912ca60836651351049fd2d

Download Submit
C:\Program Files\Private Internet Access\Qt5Qml.dll

Filesize
3.4MB

MD5
d482b871da5a079cd8caea0028ba5cdc

SHA1
c4df4cc14380b05bfee750cd114fdf9458281c22

SHA256
bdc727fe8d26aee953e113c4ef8c38876c189f619ff1e225fef935cc984cee72

SHA512
abd956e79252622ec43f09d746013363a4d21bf01ac18601a9efad551e50a633efb67ea6f3f6a6554aff06adfadcd1dc55e6a0fc6147fce268928710b55f9028

Download Submit
C:\Program Files\Private Internet Access\Qt5QmlModels.dll

Filesize
430KB

MD5
2638e03fabfe2ef87b15f6e9ff594fde

SHA1
c26f83432b0ba53c9bc966d99c722afe5aa5ee29

SHA256
273414327c156ab357ad7f8c2110083d79973d2bfbf73fe6cad7b9a5fa493dff

SHA512
9dc2777829620a6936cab41f8bc065b1a7f1ddd9f5820e42b315175747187868f84fdb80ca5f2067c725ca37811eb721b0cf59f99128a185bd0da8a978c4ff1a

Download Submit
C:\Program Files\Private Internet Access\Qt5Quick.dll

Filesize
4.0MB

MD5
9e221c3551440f6c6f00ccae2b4f7568

SHA1
20e05c23f8b921b6bcfb57634dc4d648f336208f

SHA256
2e7efe561c6f564a2c95527a064e4c96786e6869708388bbb804a2fb1dc26704

SHA512
9d5ed70e9bdfe33cf124dcf934db64d7d4fcab63e8717c9348018e0d1926cf6a9a7d93ed613cbe77846fc5c291deef410f76b9aecb14ac45c508ddc0dcf78c9e

Download Submit
C:\Program Files\Private Internet Access\Qt5WinExtras.dll

Filesize
233KB

MD5
4dcf95420a00153bf2674375f4c41b86

SHA1
f2dc4df114b4192b1a4d0e216248f7cf1bdbd4e2

SHA256
064821d520a9cd29bcc5539aea50b27e863ab0297eab81975a2b315a58ff9e27

SHA512
fd3a9bf1ad7f49c216b496e1c923d5c1bd901e7fafc5263c720d37b3a405db5c15e9b6f8a6dccc7ed56d572fc41fb9680f5675711c492aea31af14eb79628f87

Download Submit
C:\Program Files\Private Internet Access\Qt5Xml.dll

Filesize
210KB

MD5
57036b763bef1784d44b0efc287bc389

SHA1
9d41e387d476471e0be4317c7aa79a2684581424

SHA256
f5d0e1b7be89165d4c96a6f1f69bd4c230e958d4b994459c20f766ffdc14f55a

SHA512
5ba34090b6f0e8ed70e335467783e03ce3d79d13425eef55b1d4533e5a626a5c0f3611c0c05c28f656ad3aa4f74e51083a558d50a909e81140483253da4f4729

Download Submit
C:\Program Files\Private Internet Access\data\data.json

Filesize
179KB

MD5
352f95b1a1727281419c257b7ccf8315

SHA1
2567d843536823bb2d01dd70f37df9d8c42957f5

SHA256
e73236d02ed677f2cdc2aecba1e534ee85b4fa71eaaf34953556f50044e32a8b

SHA512
f6f4ac2c26d7533dc387ed7fedb1e8a56f84e7773da698c974c71781d70733eb1be9dfa853c36ddb94f4d9b2fde2a068bb38f04d9d27827a39f73b4205c728d0

Download Submit
C:\Program Files\Private Internet Access\data\data.json

Filesize
179KB

MD5
bc93ac946310714f2b8fefdd3d077eef

SHA1
4f46bb6e3dde4c79dfaea9df80562bf9d547ccdd

SHA256
4669a94230769dfc5d933dcb2316ef9b739e84e8ad9b2540c4b91aa62ee298ad

SHA512
219a7f19dac5c722bd0a13716cdf81d0631f764305de338ff8bb3a60cfc3fd76ac2f98d399dac06a30f66e7b24014a56ab3abc62f8182a2cbed624d676d28fa6

Download Submit
C:\Program Files\Private Internet Access\data\data.json

Filesize
178KB

MD5
f44b29e611e6ef88dfd7a564f0dcd1c3

SHA1
e9084e3a2ea5d3fcd92385530cce9ae0dcc39ec7

SHA256
647aa7dbf274944909ffaaf2677d11e0d42cc941bc612390271018fc96598fd4

SHA512
7a728150815b4d7b0a04ef3507cad0f396cd2ef61eee337854fd9e086b329f189844792f68694c7f4928021b53b3292d79535d958f1c6519dffff14164765038

Download Submit
C:\Program Files\Private Internet Access\kapps_core.dll

Filesize
166KB

MD5
b230e9adfee968f95d00a6e888cc90de

SHA1
b6f86f855a3d634b7c098f3ba35a12457bf7f852

SHA256
4200a1acced2b0b444158365c332d68c28979028256087f7e8cc8fc55a509e37

SHA512
e854127522bfdf31fb7eb76d7f8d5d194fa50624fc85e3882b1f61b449ba21887347dfbbcebcb4b0984e8f1651ccb13ea8c56d5487599512401e71ce25dcae86

Download Submit
C:\Program Files\Private Internet Access\kapps_net.dll

Filesize
243KB

MD5
3bcde82f04c72f6ad89906fb718c2cd3

SHA1
39025a168d4e6005610b5345ea63420fd6da3e9c

SHA256
9aeb1fa91a2523b84b17dc2b6c5e0fe7cd7d5b283aac8b9dfc143c3d08722018

SHA512
1d96d1d5c72d3dc4aac675533ad8f620f25da3dca7287902f220bf2f4d107353984d91e3861469d264c1c302b9fb77337cd24ac4b94dea05d3abfc9084701745

Download Submit
C:\Program Files\Private Internet Access\kapps_regions.dll

Filesize
377KB

MD5
39b9c43149176329b3df479c1a130c84

SHA1
92b43d4ec7d93a9cbccadd2cc8954d13ec85db67

SHA256
0a3bcdbf0a33d72b242465e2826849f51e68ef1c811bb60ff84c8e9cd2602e42

SHA512
d1e282e0e459e19a9e5eaf95d8064d0f9e0cdaf11f09418adf79f48935ca36d4bc1263672cef274018972b75cccdc006b546c92e08a7849c233dbc9a3d65745a

Download Submit
C:\Program Files\Private Internet Access\libcrypto-1_1-x64.dll

Filesize
3.5MB

MD5
88acb8c2a536290e7ef09ea634d739f7

SHA1
1f43e50f836e3024ada6be81a1c1911d2e4419c6

SHA256
6c036b347844aecac716bd4778e5fd5b4722bca81332fbcc2a4e2961fe5d8bd6

SHA512
42c18eb6102a3aaa912523b6180d98aabc34c692c2f4702b4f85bf9f7c9ee737f8f088bbf319a896a7989d88045da3186ecaf050d7ea2be8ef6f984de221725f

Download Submit
C:\Program Files\Private Internet Access\libssl-1_1-x64.dll

Filesize
911KB

MD5
09872e245ffe69a984ec930902573e49

SHA1
5b52d25220f0127c7c5045798b1b2048a0e4f982

SHA256
a0e1db1a24ecff383bf220db7621d01f1b38449a389cd0c2d251f6cdea85378b

SHA512
c1283390745a645b4bab1cd42a56fcdf20baad408c3f474b94e255d4cdd5d29ec9636a9a0813daa28c166000e638e02bd45646c0ee8a3504f4c8821347cad387

Download Submit
C:\Program Files\Private Internet Access\msvcp140_1.dll

Filesize
23KB

MD5
ab6cd7971aaf69636e9021fb3135cbf4

SHA1
ecd9c4ed543d01788212dcf701e12ae55e6bc454

SHA256
b991072665c8c812325c956e23d0335bb0bee5a86562395190ab87b8833f288d

SHA512
a62b71771ba11c93598bfd2457f6a857583eec1e1bb49d60298ceb388810759ffef17aa15e71be02a755810f12744f210b371b06d7573d4617ad6496af7dae2a

Download Submit
C:\Program Files\Private Internet Access\pia-client.exe

Filesize
5.0MB

MD5
ddd82566650f1c67c7431e64b1f52353

SHA1
f80c8487c0e98d29f149190fa2551349d883429c

SHA256
fb48c472f396526adbd0a726da44a741effa63d2540384a696b60b797e637fbb

SHA512
73eff1474d61b8312898fcd7803b79df68cbe7039f3d99cf971e9a539a001bcafc27d8b5177aea2c774ddb9b4f56a68e68b1568ccdad748acccaadb0144bf2a7

Download Submit
C:\Program Files\Private Internet Access\pia-clientlib.dll

Filesize
300KB

MD5
831e9ad1f9bfdcc73a3d89e61b33f2ab

SHA1
40051cf560c24994fcc34e10abd97a38cb6686a2

SHA256
b5ec91545352690f4761542a930064a59839fca01362e8cbadd7e38a3bc6b50c

SHA512
2f496b8b489903e03465a11053c06dbe998a1ff892bd94b7f301b6c52c40cd3c0a30fd8433c32320a2dc24a636040369c1f5ae90a797cb791f7e8e7d197b3daf

Download Submit
C:\Program Files\Private Internet Access\pia-commonlib.dll

Filesize
1.1MB

MD5
987a433b8f5495a633179535d30cb670

SHA1
cebbdcc7202f331f67f0de356e49cdb14256d714

SHA256
d5e8daa2f9105c007743efc1418c992d5468e2cfbd59f85f16d0a009562d12b9

SHA512
77e3a25514a8ed5c34ae550d73e7af66ff93b50d95edd5b529fd057be10ad793e472bace224147c5b1fa4a626610ffae8933fb8f598104959251fa58445bae1b

Download Submit
C:\Program Files\Private Internet Access\pia-service.exe

Filesize
1.3MB

MD5
02ca4871eba5c092cd5918c59109cbc1

SHA1
7db333c6cda61a4895bb9a43350d25148475e53e

SHA256
2e53256b7105f772905aff51def75959c4c705f0dc4772953774517f2218ba39

SHA512
7e9bd4a1041d8e4fdcf90741b355ceb632f6abbe22d53ce9b16571b46cdfd2f0dd9e522f6387988c485172073949449808e0d4686cc70828f35381aafe8df1c7

Download Submit
C:\Program Files\Private Internet Access\pia-unbound.exe

Filesize
1.3MB

MD5
ffa3104b429bf522d5e148771e14073c

SHA1
3f153f8e3d9ff0667be227d0be9cecab3cb7a309

SHA256
e38dd45a53b02a21355bebfae2f8e8eb69d881cded40f5e357669222686d2441

SHA512
2f856ce7d51cff02513691801512ce1698986c8642800d4988cb0db21bed7eab01578569703ab0b69a2f7a2f4d6ca3e33fc042bfad2be783424b4ff922183e31

Download Submit
C:\Program Files\Private Internet Access\tap\win10\OemVista.inf

Filesize
7KB

MD5
75d7bbba25d646f4d8e64a46e8d5f189

SHA1
09af2f1e0604abff1f4f944cf653c1c08d619a95

SHA256
20b0989f66a23ef6b1b2e17e064a069de8655f1e423925eac495ebb840181bce

SHA512
ca028c66945f9b84521249a37e526aada855d4f2ee665941fea44e382c626014545cc169a9843059d513daded6a61f20bf48fe176339c9c50743a5ab12d7dd38

Download Submit
C:\Program Files\Private Internet Access\tap\win10\tap-pia-0901.sys

Filesize
39KB

MD5
92f6261306d323052b9d81c8bcbc25ca

SHA1
737661771827b349f01a581f73a7555e8f7e569d

SHA256
3ca3816bfb2366f7ba4650ef33f14ce2a7a4fa66631f345b7ad09808b5e78563

SHA512
4e562404aa596fe01b4e56678b521c511aa952f2e5593cb99df301855879fd6e422759cafe1f4441555e9fc75eb9f7e61bdf135c2bbcbdf6b96bbceb4c6a4f4a

Download Submit
C:\Program Files\Private Internet Access\vcruntime140.dll

Filesize
94KB

MD5
afc14553cb2555656da51f35b3f42e64

SHA1
37da6a26f62a0e9870737c2d3962eb8c16a0f244

SHA256
e8e1d3723dea6212243a593ee7e17238ce112c6d108d97b766ba51c8cf1d2b7c

SHA512
c47df379826c6b0045669d50bcabdd8a108eea6ee49a6637ac50fe392c36135e3a4c623e778fa6cc0bef5407563f997729d898d31dccb2d05f8a793be40a1263

Download Submit
C:\Program Files\Private Internet Access\vcruntime140_1.dll

Filesize
36KB

MD5
482f4bbfb112b6a2751c491f22abcdcc

SHA1
b219b56802e75e9e889f78b5dcfc66a1b4c7975f

SHA256
9cf6cf0f01cd6b3584ae5f57386f1834d9d7225dc9ad47b94ad0ab0a6d370c2f

SHA512
3b4965cb715727346e3b181956e8a54f3804253b1773f57eb55fd34de13cf0de0e428ae1eed9c77a95f59ad024e6d895d36215c5655fa6133af68635462ddbb9

Download Submit
C:\Program Files\Private Internet Access\wintun\pia-wintun.msi

Filesize
316KB

MD5
810b7cab39784a5eb7f3f36407230173

SHA1
d556a1bca0965b3fc84b902af6d6b62c68f25e88

SHA256
6eaa3ddbe1603d20d25349fadb3517143de5423755d6bfe78ac2b7f4f8d9dbe5

SHA512
5f29c83ac59e66754475c5451093c6f1df980d2a382754f2baebbec06417524bf64d7d0a2a3e3c219392c31d5c0a1d6e04a68616d59b5540d4eb29835e1bdf99

Download Submit
C:\Windows\System32\DriverStore\Temp\{4dc6ecf1-7a57-0b4e-9700-14a2a3c80a1e}\wintun.cat

Filesize
9KB

MD5
faba2ccb8fe366fd281ca6be6d2bb7c2

SHA1
bb7bd32a21f3eba652fde24146387ffc5278143e

SHA256
602187e5470ddbdf9421045bb0515f358c88bf88f59fd8a886fb6373da5d0f82

SHA512
ec424a545e2598f299706499dab07b4d12b0734a52f928216a53bca2b7f384b97bd4fc092d7d68de636a75daf79ac392c4b49b7251ec011236de1659253d6214

Download Submit
C:\Windows\System32\DriverStore\Temp\{4dc6ecf1-7a57-0b4e-9700-14a2a3c80a1e}\wintun.sys

Filesize
37KB

MD5
1945d7d1f56b67ae1cad6ffe13a01985

SHA1
2c1a369f9e12e5c6549439e60dd6c728bf1bffde

SHA256
eb58bf00df7b4f98334178e75df3348c609ea5c6c74cf7f185f363aa23976c8b

SHA512
09af87898528eaa657d46c79b7c4ebc0e415478a421b0b97355294c059878178eb32e172979ee9b7c59126861d51a5831e337a96666c43c96cb1cf8f11bc0a0f

Download Submit
C:\Windows\Temp\ebc95c55fe32344ee58c261566eedf6406ef0f0d10a47dd81ecbdb45b9119f9f\wintun.inf

Filesize
1KB

MD5
8480579050970b0812cc3d9a1bce1340

SHA1
edebebd090602f4eee375ad754c8566d4fda23cb

SHA256
44098408ab9611dd99a38e140c7fb1ca5dce6eb2d5f0d5e500547ac1ba5d235b

SHA512
46de9202c3cf0ddbf19f9e0e02ec17530f2722abfa08669fd30a6095ce2342fa89a2cc59c1d47afd82b48c915bb95f4c6d16e7c21129a9c8f09c2bf239566933

Download Submit
memory/632-2094-0x000002042C210000-0x000002042C211000-memory.dmp

Filesize
4KB

Download
memory/632-2114-0x000002042C670000-0x000002042C671000-memory.dmp

Filesize
4KB

Download
memory/632-2089-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-2088-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-2087-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-2086-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-2098-0x000002042C210000-0x000002042C211000-memory.dmp

Filesize
4KB

Download
memory/632-2097-0x000002042C210000-0x000002042C211000-memory.dmp

Filesize
4KB

Download
memory/632-2096-0x000002042C210000-0x000002042C211000-memory.dmp

Filesize
4KB

Download
memory/632-2095-0x000002042C210000-0x000002042C211000-memory.dmp

Filesize
4KB

Download
memory/632-1915-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-2093-0x000002042C210000-0x000002042C211000-memory.dmp

Filesize
4KB

Download
memory/632-2091-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-2099-0x000002042C210000-0x000002042C211000-memory.dmp

Filesize
4KB

Download
memory/632-2100-0x000002042C210000-0x000002042C211000-memory.dmp

Filesize
4KB

Download
memory/632-2105-0x000002042C210000-0x000002042C211000-memory.dmp

Filesize
4KB

Download
memory/632-2104-0x000002042C630000-0x000002042C631000-memory.dmp

Filesize
4KB

Download
memory/632-2103-0x000002042C630000-0x000002042C631000-memory.dmp

Filesize
4KB

Download
memory/632-2101-0x000002042C210000-0x000002042C211000-memory.dmp

Filesize
4KB

Download
memory/632-2109-0x000002042C630000-0x000002042C631000-memory.dmp

Filesize
4KB

Download
memory/632-2107-0x000002042C630000-0x000002042C631000-memory.dmp

Filesize
4KB

Download
memory/632-2106-0x000002042C630000-0x000002042C631000-memory.dmp

Filesize
4KB

Download
memory/632-2108-0x000002042C630000-0x000002042C631000-memory.dmp

Filesize
4KB

Download
memory/632-2110-0x000002042C630000-0x000002042C631000-memory.dmp

Filesize
4KB

Download
memory/632-2111-0x000002042C630000-0x000002042C631000-memory.dmp

Filesize
4KB

Download
memory/632-2112-0x000002042C630000-0x000002042C631000-memory.dmp

Filesize
4KB

Download
memory/632-2117-0x000002042C670000-0x000002042C671000-memory.dmp

Filesize
4KB

Download
memory/632-1911-0x000002042AE30000-0x000002042B270000-memory.dmp

Filesize
4.2MB

Download
memory/632-2116-0x000002042C670000-0x000002042C671000-memory.dmp

Filesize
4KB

Download
memory/632-2115-0x000002042C630000-0x000002042C631000-memory.dmp

Filesize
4KB

Download
memory/632-2118-0x000002042C670000-0x000002042C671000-memory.dmp

Filesize
4KB

Download
memory/632-1910-0x00007FFCF7950000-0x00007FFCF7D48000-memory.dmp

Filesize
4.0MB

Download
memory/632-1913-0x000002042B270000-0x000002042B470000-memory.dmp

Filesize
2.0MB

Download
memory/632-1916-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-1917-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-1918-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-1919-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-2301-0x000002042C6B0000-0x000002042C6B1000-memory.dmp

Filesize
4KB

Download
memory/632-2300-0x000002042C6B0000-0x000002042C6B1000-memory.dmp

Filesize
4KB

Download
memory/632-1920-0x000002042B870000-0x000002042B871000-memory.dmp

Filesize
4KB

Download
memory/632-2317-0x000002042C6D0000-0x000002042C6D1000-memory.dmp

Filesize
4KB

Download
memory/632-2315-0x000002042C6C0000-0x000002042C6C1000-memory.dmp

Filesize
4KB

Download
memory/632-2314-0x000002042C6C0000-0x000002042C6C1000-memory.dmp

Filesize
4KB

Download
memory/632-2313-0x000002042C6C0000-0x000002042C6C1000-memory.dmp

Filesize
4KB

Download
memory/632-2312-0x000002042C6C0000-0x000002042C6C1000-memory.dmp

Filesize
4KB

Download
memory/632-2311-0x000002042C6C0000-0x000002042C6C1000-memory.dmp

Filesize
4KB

Download
memory/632-2310-0x000002042C6B0000-0x000002042C6B1000-memory.dmp

Filesize
4KB

Download
memory/632-2309-0x000002042C6B0000-0x000002042C6B1000-memory.dmp

Filesize
4KB

Download
memory/632-2308-0x000002042C6B0000-0x000002042C6B1000-memory.dmp

Filesize
4KB

Download
memory/632-2307-0x000002042C6C0000-0x000002042C6C1000-memory.dmp

Filesize
4KB

Download
memory/632-2305-0x000002042C6B0000-0x000002042C6B1000-memory.dmp

Filesize
4KB

Download
memory/632-2304-0x000002042C670000-0x000002042C671000-memory.dmp

Filesize
4KB

Download
memory/632-2303-0x000002042C670000-0x000002042C671000-memory.dmp

Filesize
4KB

Download
memory/1676-2120-0x00007FFCF8980000-0x00007FFCF8A43000-memory.dmp

Filesize
780KB

Download
memory/1676-2119-0x00007FFCF8C70000-0x00007FFCF8F79000-memory.dmp

Filesize
3.0MB

Download
memory/4468-2297-0x00000000009C0000-0x0000000000E25000-memory.dmp

Filesize
4.4MB

Download