2000b92a133aa0dba2124e58ea4ebaff0382cab6e7e217885922fad6c4840d46

Analysis

user interaction
yes
max time kernel
152s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ExpanDrive Setup 2026.02.09.exe
Size 265.3MB
Sample260714-rceq8aes4m
SHA256 2000b92a133aa0dba2124e58ea4ebaff0382cab6e7e217885922fad6c4840d46
MD5 8113d3c8be67925433856a40b1723e02
SHA1 237318fe042aac9e91236057607e068f79f30a06
SHA512 2e9bead4b146551408956b7d75e1d42dfff936e4c31d7dbdb396a3c581ca82c28fee599cd297745089fee9a386bca5bb1a6a41476a64eb7e97fd9ae7e459f2ad
SSDEEP 6291456:7mPfqKtM/hBx1TdZ5eS/BKsmBosPcu17VMwMPE2+wYwITOLdiwn9F71gFRl:anqKtMbIS/ssmBlUuJVtwYwIadiw9F1G
TLSH
T1B1D83351F39EC648EAEB183CEED168D53A529C32D1A23183260D7F5EC2634F61DF6918
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation spyware trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\EldosMountNotificator-cbfs6 = "{AB81C78F-B728-412E-BA4D-9989FD0F989E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\EldosMountNotificator-cbfs6 = "{AB81C78F-B728-412E-BA4D-9989FD0F989E}"	exinstall.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\cbfs6.sys	exinstall.exe

Modifies Shared Task Scheduler registry keys 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{AB81C78F-B728-412E-BA4D-9989FD0F989E} = "Virtual Storage Mount Notification"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	exinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{AB81C78F-B728-412E-BA4D-9989FD0F989E} = "Virtual Storage Mount Notification"	exinstall.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ExpanDrive.exe = "C:\\Users\\Admin\\AppData\\Local\\ExpanDrive\\Update.exe --processStart \"ExpanDrive.exe\" --process-start-args /AUTORUN"	ExpanDrive.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\elevtmsg.dll	exinstall.exe
File created	C:\Windows\system32\cbfsNetRdr6.dll	exinstall.exe
File created	C:\Windows\SysWOW64\cbfsNetRdr6.dll	exinstall.exe
File created	C:\Windows\system32\cbfsMntNtf6.dll	exinstall.exe
File created	C:\Windows\SysWOW64\cbfsMntNtf6.dll	exinstall.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 13 IoCs

pid	Process
4568	Update.exe
3396	ExpanDrive.exe
4440	Update.exe
2092	ExpanDrive.exe
2172	Update.exe
432	exfs.exe
2288	exinstall.exe
1644	ExpanDrive.exe
4812	cbfs6.sys
1376	ExpanDrive.exe
5020	Update.exe
716	Update.exe
3688	ExpanDrive.exe

Loads dropped DLL 18 IoCs

pid	Process
3396	ExpanDrive.exe
3396	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2288	exinstall.exe
2288	exinstall.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
1644	ExpanDrive.exe
3372	regsvr32.exe
2092	ExpanDrive.exe
1376	ExpanDrive.exe
3300	regsvr32.exe
4304	regsvr32.exe
3688	ExpanDrive.exe
3688	ExpanDrive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExpanDrive Setup 2026.02.09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB81C78F-B728-412E-BA4D-9989FD0F989E}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AE1ABDF-534D-44A7-9D14-3B6A65ADAF55}\InprocServer32	exinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\ExpanDriveContextMenus\ = "{00472127-8960-4878-909F-A59FEA944CFA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1711-612C-460A-9685-C7F0C336EF65}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB81C78F-B728-412E-BA4D-9989FD0F989E}\InprocServer32\ = "C:\\Windows\\SysWOW64\\cbfsMntNtf6.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AE1ABDF-534D-44A7-9D14-3B6A65ADAF55}\InprocServer32\ThreadingModel = "Apartment"	exinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AE1ABDF-534D-44A7-9D14-3B6A65ADAF55}	exinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00472127-8960-4878-909F-A59FEA944CFA}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\ExpanDrive\\ExpanDriveContextMenus_x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1711-612C-460A-9685-C7F0C336EF65}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}\2.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00472127-8960-4878-909F-A59FEA944CFA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ExpanDriveContextMenus\ = "{00472127-8960-4878-909F-A59FEA944CFA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1712-612C-460A-9685-C7F0C336EF65}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1712-612C-460A-9685-C7F0C336EF65}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\ExpanDrive\\ExpanDriveOverlays_x64.2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB81C78F-B728-412E-BA4D-9989FD0F989E}\InprocServer32	exinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AE1ABDF-534D-44A7-9D14-3B6A65ADAF55}\ = "VSMntNtfOverlayIcon Class"	exinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}\2.0\0\win64	exinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB81C78F-B728-412E-BA4D-9989FD0F989E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AE1ABDF-534D-44A7-9D14-3B6A65ADAF55}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}\2.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00472127-8960-4878-909F-A59FEA944CFA}\InprocServer32\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1713-612C-460A-9685-C7F0C336EF65}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\ExpanDrive\\ExpanDriveOverlays_x64.2.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}\2.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cbfs6-ExpanDrive5\\i386\\cbfsMntNtf6.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5AE1ABDF-534D-44A7-9D14-3B6A65ADAF55}\InprocServer32\ = "C:\\Windows\\system32\\cbfsMntNtf6.dll"	exinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00472127-8960-4878-909F-A59FEA944CFA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB81C78F-B728-412E-BA4D-9989FD0F989E}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AE1ABDF-534D-44A7-9D14-3B6A65ADAF55}\ = "VSMntNtfOverlayIcon Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}\2.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	exinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1711-612C-460A-9685-C7F0C336EF65}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\ExpanDrive\\ExpanDriveOverlays_x64.2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}\2.0\ = "VSMntNtf 2.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}\2.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	exinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00472127-8960-4878-909F-A59FEA944CFA}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1713-612C-460A-9685-C7F0C336EF65}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1713-612C-460A-9685-C7F0C336EF65}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1713-612C-460A-9685-C7F0C336EF65}\InprocServer32\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB81C78F-B728-412E-BA4D-9989FD0F989E}\ = "Virtual Storage Mount Notification"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AE1ABDF-534D-44A7-9D14-3B6A65ADAF55}\InprocServer32\ = "C:\\Windows\\SysWOW64\\cbfsMntNtf6.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB81C78F-B728-412E-BA4D-9989FD0F989E}\InprocServer32\ = "C:\\Windows\\system32\\cbfsMntNtf6.dll"	exinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	exinstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}\TypeLib\ = "{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB81C78F-B728-412E-BA4D-9989FD0F989E}	exinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	exinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	exinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1713-612C-460A-9685-C7F0C336EF65}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}\ = "IVSMntNtfOverlayIcon"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB81C78F-B728-412E-BA4D-9989FD0F989E}\InprocServer32\ThreadingModel = "Apartment"	exinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ExpanDriveContextMenus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{468B1712-612C-460A-9685-C7F0C336EF65}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AE1ABDF-534D-44A7-9D14-3B6A65ADAF55}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}\2.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cbfs6-ExpanDrive5\\i386"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4169414-65DA-4F27-8A9E-3A4FE9420ED7}\TypeLib\ = "{B7BC20E8-B4CC-4EF3-B165-E2AE2AE8863A}"	regsvr32.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
3564	reg.exe
4572	reg.exe
4976	reg.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	ExpanDrive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	ExpanDrive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	ExpanDrive.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4568	Update.exe
4568	Update.exe
432	exfs.exe
432	exfs.exe
716	Update.exe
716	Update.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
812	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	Update.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeDebugPrivilege	5020	Update.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeDebugPrivilege	716	Update.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe
Token: SeCreatePagefilePrivilege	2092	ExpanDrive.exe
Token: SeShutdownPrivilege	2092	ExpanDrive.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4568	Update.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe
2092	ExpanDrive.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4568	5084	ExpanDrive Setup 2026.02.09.exe	88
PID 4568 wrote to memory of 3396	4568	Update.exe	89
PID 3396 wrote to memory of 3564	3396	ExpanDrive.exe	90
PID 3396 wrote to memory of 4440	3396	ExpanDrive.exe	92
PID 4568 wrote to memory of 2092	4568	Update.exe	93
PID 2092 wrote to memory of 4572	2092	ExpanDrive.exe	95
PID 2092 wrote to memory of 2172	2092	ExpanDrive.exe	97
PID 2092 wrote to memory of 432	2092	ExpanDrive.exe	98
PID 2092 wrote to memory of 4548	2092	ExpanDrive.exe	99
PID 432 wrote to memory of 2288	432	exfs.exe	101
PID 2092 wrote to memory of 1644	2092	ExpanDrive.exe	103
PID 2288 wrote to memory of 3372	2288	exinstall.exe	104
PID 2092 wrote to memory of 1376	2092	ExpanDrive.exe	106
PID 2288 wrote to memory of 3300	2288	exinstall.exe	107
PID 2288 wrote to memory of 5712	2288	exinstall.exe	108
PID 2288 wrote to memory of 4304	2288	exinstall.exe	109
PID 2092 wrote to memory of 5020	2092	ExpanDrive.exe	112
PID 2092 wrote to memory of 716	2092	ExpanDrive.exe	113
PID 716 wrote to memory of 3688	716	Update.exe	114
PID 3688 wrote to memory of 4976	3688	ExpanDrive.exe	115

C:\Users\Admin\AppData\Local\Temp\ExpanDrive Setup 2026.02.09.exe
"C:\Users\Admin\AppData\Local\Temp\ExpanDrive Setup 2026.02.09.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ExpanDrive.exe
    "C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ExpanDrive.exe" --squirrel-install 2026.2.9
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64 /v Installed
      4⤵
      Modifies registry key
      PID:3564
  - - C:\Users\Admin\AppData\Local\ExpanDrive\Update.exe
      C:\Users\Admin\AppData\Local\ExpanDrive\Update.exe --createShortcut=ExpanDrive.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4440
- - C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ExpanDrive.exe
    "C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ExpanDrive.exe" --squirrel-firstrun
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64 /v Installed
      4⤵
      Modifies registry key
      PID:4572
  - - C:\Users\Admin\AppData\Local\ExpanDrive\Update.exe
      C:\Users\Admin\AppData\Local\ExpanDrive\Update.exe --createShortcut=ExpanDrive.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2172
  - - C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\SharedSupport\exfs.exe
      C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\SharedSupport\exfs.exe exinstall=true exfs=true
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\SharedSupport\exinstall.exe
        
        "C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\SharedSupport\exinstall.exe"
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in Drivers directory
        Modifies Shared Task Scheduler registry keys
        Drops file in System32 directory
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2288
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\SysWOW64\regsvr32.exe" /n /s /i:"cbfs6-ExpanDrive5" "C:\Users\Admin\AppData\Local\Temp\cbfs6-ExpanDrive5\i386\cbfsMntNtf6.dll"
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies Shared Task Scheduler registry keys
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3372
      - C:\Windows\System32\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /S C:\Users\Admin\AppData\Local\ExpanDrive\ExpanDriveContextMenus_x64.dll
        6⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:3300
      - C:\Windows\System32\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /S /U C:\Users\Admin\AppData\Local\ExpanDrive\ExpanDriveOverlays_x64.dll
        6⤵
        
        PID:5712
      - C:\Windows\System32\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /S C:\Users\Admin\AppData\Local\ExpanDrive\ExpanDriveOverlays_x64.2.dll
        6⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:4304
  - - C:\Windows\system32\reg.exe
      C:\Windows\system32\reg.exe QUERY "HKLM\Software\ExpanDrive, Inc.\ExpanDrive"
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ExpanDrive.exe
      "C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ExpanDrive.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --use-angle=swiftshader-webgl --use-gl=angle --user-data-dir="C:\Users\Admin\AppData\Roaming\ExpanDrive" --mojo-platform-channel-handle=2264 --field-trial-handle=2416,i,7746121305871768403,10629305400545969509,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1644
  - - C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ExpanDrive.exe
      "C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ExpanDrive.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ExpanDrive" --app-user-model-id="C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ExpanDrive.exe" --app-path="C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2536 --field-trial-handle=2416,i,7746121305871768403,10629305400545969509,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1376
  - - C:\Users\Admin\AppData\Local\ExpanDrive\Update.exe
      C:\Users\Admin\AppData\Local\ExpanDrive\Update.exe --checkForUpdate https://updates.expandrive.com/appcast/expandrive7_win64?version=2026.02.09
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5020
  - - C:\Users\Admin\AppData\Local\ExpanDrive\Update.exe
      C:\Users\Admin\AppData\Local\ExpanDrive\Update.exe --update https://updates.expandrive.com/appcast/expandrive7_win64?version=2026.02.09
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:716
    - - C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.06.11\ExpanDrive.exe
        
        "C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.06.11\ExpanDrive.exe" --squirrel-updated 2026.06.11
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3688
      - C:\Windows\system32\reg.exe
        
        reg query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X64 /v Installed
        6⤵
        Modifies registry key
        
        PID:4976

C:\Windows\system32\drivers\cbfs6.sys
C:\Windows\system32\drivers\cbfs6.sys
1⤵
- Executes dropped EXE
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cbfs.cab

Path C:\Users\Admin\AppData\Local\EXPAND~1\APP-20~1.9\SHARED~1\cbfs.cab
Size 1.6MB
SHA256 90a9ac38b2b4cbe125d9658012cf0d76152f7d572d239ea34d73746814f42113
MD5 29fadf572f61c66da8395ed45b27da7d
SHA1 fabd817b6e2185ea586aeba038068553f75d1a62
SHA512 9aa0fc8935bf242b6d6e53cfa6131429f86a2296ded77a3d863df83efb39a547aba07d7230fcfaa15c5c558afe1ab90821823f41f4329f509c22bd9df60dfb18
SSDEEP 49152:rgrA2TTqAe9xg4Roe3nDDOh0sXCjM8tbK1UnC3DWufGyf8ysd9pc:8rA2GDtR9D6usU3Ev33fQTc
TLSH
T1E9753344FA30526B254A41FA2060B32784292FDEDCE36D62EAC4496B764B7CE43773D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpanDrive.exe

Path C:\Users\Admin\AppData\Local\ExpanDrive\ExpanDrive.exe
Size 607KB
SHA256 8d15a803b7947c3ba1489f8a64e15769420ca417b391644c117399d00ea6bc72
MD5 1b8de275aebb1dd3d1a8e65039566e2a
SHA1 93a03dedb2b1dcc4a3b574edebc7c3090675509c
SHA512 be8af12164ee1de61c419d468f22a3681e0ea003a16b01674e5a0479b18e231acdf1aab4991bc015b4e34401415b36c15819b81dbab4725d663e975035ecee26
SSDEEP 3072:PBPlwpY3YKF0MrrJq+DNBg0DJtOJs9cAg0Fub+A5aiMBVzVUDHnR5fstZRIvq:Zc2XFRJ3DNuzAOS9FB1aWYvq
TLSH
T1EFD4E510F7E1C2B2C5E30933CCE7A7E07A25ADB6CA52762B32C47B2DDA361815513B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\ExpanDrive\SquirrelSetup.log
Size 1KB
SHA256 63de827ef2b297527221b0b80d5cdb9e981bd1477bb542dd1ecf5ab8c89bbf04
MD5 2f1846fd923e3cb589992780666e9a3b
SHA1 a2e6a916daf71c5a642e09d04fb95b64283de0f4
SHA512 32c4884d5b2fec0ebeb2ec7f79d576056080e548284225711377353b18d47208f2efb7ac2b25e9ece73c7bc806362d7a7e4eacface2afa621b1e9e939c5b14d7
TLSH
T1E1217771F3C5C57D058374878F32AADEC1C2B80A36542A70A742842C328BA1DB8CF4A3
MD5 SHA1 SHA512 TLSH

Submit Download

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\ExpanDrive\SquirrelSetup.log
Size 2KB
SHA256 e4a5619f9dc786785edc10b28acd73e59599dbd6c0976a9162b5d7c1f115a3de
MD5 7737815ce1756dafe2003ea35d5c2409
SHA1 41dc107902b23630b000470abb14160bf9f08d84
SHA512 3e3f1b8878640b9822f6aed3fd18f592015e197a949ad5e9382a07bd6db04bb38ba4a966b24e9dac3d5a5a7550ef04ecfa130ecbe67d9930fdecf573fe0cad08
TLSH
T1ED515962F3C5C17D454374878B32ABDEC1D7E90A36647A30A742842D328BA1DB9CF4A7
MD5 SHA1 SHA512 TLSH

Submit Download

SquirrelSetup.log

Path C:\Users\Admin\AppData\Local\ExpanDrive\SquirrelSetup.log
Size 4KB
SHA256 3f9cbff69ae3ccad0a98ff1fd6cc5d1fea8ed85aeea293948a4ed5fcd58ac2a8
MD5 490b8098e0f50adffd2b2713b0ac9c93
SHA1 ba997fe87facfe373ec4440df7a047de9c59e7bd
SHA512 4a424291b523b2534230faf1971fe95a125a760c54070207ea9d010ad8b4f98bcc572bb05464329d56a3208ca0c6c8b98b34cdae115559e9fe551bb05a249493
SSDEEP 96:gAmIF1uE7u9dKfYpQLqhdKfYpQL7PmRF+uEcu9dKfYpQLJKdKfYpQLw+avAvzhva:t4Q2QP3QoQTa4dIelQ82
TLSH
T1A391FE72B3C1C13E068274878B36A78EC5E6E40A376526B4B791902D374B61EB5CF0E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpanDriveContextMenus_x64.dll

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\SharedSupport\ExpanDriveContextMenus_x64.dll
Size 636KB
SHA256 5c5b09bc5ae85e4b51fd86f958b88b2cb6cb75fd0bf08e23b83144350d2ba3c1
MD5 c5d36795b6ef65305d969cecb7922266
SHA1 faa180d61dce2a22a6520529ebd59fa14241dfd7
SHA512 d7f3646d8c8dc9633f50a283dde32b6bd0906f98556b1dddab5309f737c2c0e09044c639e17521d14a21d5ff161c18dd5743a4a12564c15f551f331eb57a8abf
SSDEEP 12288:vgltLEDLC1f8nc+RafsyzH6ROZhpiBMebF6RPZIHdum2Hcd6dcZGt4OYk6Jz3gxw:oltLEfC1ff4rdk6Jzwx3re
TLSH
T19BD48D1A72AC41B8E1A7E17889974512E7B2784613619BDF03B0077B2F6B7E11F7E360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpanDriveOverlays_x64.2.dll

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\SharedSupport\ExpanDriveOverlays_x64.2.dll
Size 436KB
SHA256 8d008f6e5467abf3d203e176be52ade8adb21f0c1faee62df761eda866ccda86
MD5 73196e47fe217b4c63ac96d300be3b37
SHA1 91b90997354714a9eb08c25c91333db900c7d1b9
SHA512 df7e783bec5548bd63ba4638360d4bd2ffbf40490a1aa3fb78916957d24051002a500185e4ba6616dd2dff57d06736e351e433edaaef5b49ac9ca104cc015125
SSDEEP 6144:czlt72hGctHkZ9D1qow6YW1UV3oLO5/NA1nmAYK0rohHy/zWfwZ5f:czltqt69D1qNig3Ky++HroYy
TLSH
T12C948C1AF2A904B9D06B9238C9A35942F6727C4A0760CBEF03A056776F33BD05D7E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExpanDriveShellIcons.2.dll

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\SharedSupport\ExpanDriveShellIcons.2.dll
Size 533KB
SHA256 b9d56dd5253e88c20dad15c3ebdb006a7821033c4a8efc69832b61fa2c774536
MD5 59487434c682561787ae62dce2b7d593
SHA1 1a2f2d35002b084d1d0f077479f7b008ef72853a
SHA512 b754b603f41396525ccc7108c4c95c084f69e887614c35604592d35c4435683573b3ea99822459c8754a19ee0bc27a258ad594f16d4e5c63806033275fa8315d
SSDEEP 3072:Lkp3m7wajWJgwRggcSoy3IxHexVsL/I4qVvIVzVUDHnR5fstE6:LD7w73WpSVcMmzIm1aWE6
TLSH
T14FC4E504F7E0C2A3D5EB1837DCD3A7D07A24AEB6C8D1760A25D43F2AE67345294137A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exfs.exe

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\SharedSupport\exfs.exe
Size 6.5MB
SHA256 41256db1dcbf0fb6831b7ce58e715d51ffab83f74012541c41ef6fb386e53d1b
MD5 1cce2e137f1e3d60146613c8bad2ef67
SHA1 53984210c77cc35887dc867a392dedc6fe794a11
SHA512 9596dffd69faa6d32f292465666c4ad2169542ae8149699accbc050d89f7937e6529f0c3071f5a753c26deae441411890235d4e6db2689deb563b72bb537dd70
SSDEEP 98304:Tm+cpi+NH7suTzYJqd+8RR/VjFmj0paUZoS8sj/F:qppXL8Yd+W/VjP4UZoS8sbF
TLSH
T197665B46E3A4C1ECD1EBD178CDC64993F2B174399330B7EB5690866A9F236E15E39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exinstall.exe

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\SharedSupport\exinstall.exe
Size 474KB
SHA256 4b9048038463311dfcde0b928b4f739816d2354f9119a38f20a89294c61775b7
MD5 8433dd545873067f6c4df3d8cd3e657b
SHA1 d5d79d732e7221f3170a93aaae62924da8f2cfa5
SHA512 f188898965a3559afaaf86a5702e65f77c58c9401d238116ea2dd14f57390c6d6e5b5e43fb28bbcd4b9dbfba4064eaa6cf0641127218dabb3357ce2cb5f70b67
SSDEEP 3072:Ju5CCggJvqlbqb+u+EXilt6H2rjfjiIVzVUDHnR5fst:tWyU+Jllt6HYj91aW
TLSH
T163A43B09F7E4C2A5E5E7447BCDD3A2C1B7613CBADB11378B22807B69DE332959D26201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\chrome_100_percent.pak
Size 126KB
SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
MD5 d31f3439e2a3f7bee4ddd26f46a2b83f
SHA1 c5a26f86eb119ae364c5bf707bebed7e871fc214
SHA512 aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5
SSDEEP 3072:5KzwqCT4waJL2myFhPNL2o418Gb0+VRLf0ld0GY3cQ39Vm2I:5Kzwt4LwmU3K18Gb0OV8ld0GecQ3f2
TLSH
T1B6C3E0D3B3F4EE7DDE9756B7A2160072ECB346640AD1424A178ED8362A36748D9C8783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\chrome_200_percent.pak
Size 175KB
SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
MD5 5604b67e3f03ab2741f910a250c91137
SHA1 a4bb15ac7914c22575f1051a29c448f215fe027f
SHA512 5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d
SSDEEP 3072:+DQYaEQN6AJPRJL2myFhPNafR54x5GMR+F44ffbdZnYw9p4AbIVGYoDd+HxNK/r4:+DQYaNN68RwmU0gx5GMRejnbdZnVE6YR
TLSH
T15304E1D773F89E7CC9630AB7622601F1ECF2113559B6525B17CF9C353A96B8889C8283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\d3dcompiler_47.dll
Size 4.7MB
SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
MD5 cb9807f6cf55ad799e920b7e0f97df99
SHA1 bb76012ded5acd103adad49436612d073d159b29
SHA512 f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
SSDEEP 49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
TLSH
T19E367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\ffmpeg.dll
Size 2.6MB
SHA256 6ef89a5f0d8a54546dbb95600bbeec5d9ea1d68d0a4535199d121f3ff51ddf61
MD5 9f4c2cd406d09e3e21c6a2fe3010b6cd
SHA1 66310a5f5b4b739b2f53d1bb1c3895f7633d5cce
SHA512 cff35bc413f07b710af5957f55c5d6a056b485a0654badea8a26a8a816cdad65102ce45f3a34d86cf6d6b6acc7945efdba4cfb8217c737633939328d235900ed
SSDEEP 49152:TqMAAYNDEmcTfAZMHkwfPYX6Edxhi1uGaVrFY7Q9b5hpN3lzl3hHLNoJP:TGDfRMHR8rFYU5hNA
TLSH
T1A5D5AE07F6D600E9D01DC574879F9233F631384A4B24A5EB1A91AA242F7BFD46E3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\icudtl.dat
Size 10.0MB
SHA256 97b978a19edd4746e9a44d9a44bb4bc519e127a203c247837ec0922f573449e3
MD5 76bef9b8bb32e1e54fe1054c97b84a10
SHA1 05dfea2a3afeda799ab01bb7fbce628cacd596f4
SHA512 7330df8129e7a0b7b3655498b2593321595ec29445ea193c8f473c593590f5701eb7125ff6e5cde970c54765f9565fa51c2c54af6e2127f582ab45efa7a3a0f6
SSDEEP 196608:p5zwSv9AAyse6liXUxCGZHa93Whlw6ZCXU0:pyKlysTliXUxCGZHa93Whlw6ZCX1
TLSH
T101B62807A2FB8DC2F9F76F30D9F452679567BD496E32805A11042F3B1C337A08661BA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\libegl.dll
Size 473KB
SHA256 a2824bfdcbf147847dd697b757bca1633a2a953edcea69ba9b36bafe88ecd641
MD5 382b35ab879fbd2346b143f7098d763b
SHA1 b8c8f22969afa78d3e2feaed4b03410b6b581b75
SHA512 15c124cdf287910e5db4072f24e4230c242b3efddb155b3b9c55287d2fd336622f56a5ec3f1b68771eee8d2fa20dc62fceea288505413ee53cd17a24504ec22a
SSDEEP 6144:GTv0fq4dz9B4x4w/jvtGW9ZST3BypG48yOnb4pgsHVlAYn6eZRO8:GTN4dNw/jvtGW9c3BypaagYnDRO
TLSH
T104A47C11779954A8D03AC434CA134612EA76B8960F35FADF02A4D27D2F77BF85B3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\libglesv2.dll
Size 7.2MB
SHA256 c9a713a18b2589b8d84c1118eace437ddca2beef25041a98394a5082c4ef838b
MD5 729a0c4b53fc3f768f63e9f57e666e7b
SHA1 b76acef2fc1c913696c339b8c9f18a62a4f939b7
SHA512 ba5158c14539bab94ffafa9f4f0a41a979dcd7d661d26c254e9a5c5af0e5bd929db086c70363522efa0373a945907fb0323f12398b2b30ce8fff15caab91a32c
SSDEEP 98304:NB7j4/0BuPMTUDUaG2u/hHnr7f7gsOMkE:748KPBGznr7fcsf
TLSH
T164766A07E6A581E9C05DD2B88B5B9223FD31BC494B24B2DF2A6437112F73BE06B79750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\locales\en-US.pak
Size 313KB
SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
MD5 3f6f4b2c2f24e3893882cdaa1ccfe1a3
SHA1 b021cca30e774e0b91ee21b5beb030fea646098f
SHA512 bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c
SSDEEP 6144:SssphRVKuQ+KVMP9elsY4ZfaYe7RqIZ5HS5xswS:JsIvVMNY467Rv5HSPswS
TLSH
T1FA645D1FE7842266069312627F05A5A2FB36D06DA35112673CBC813C33B7B66C3776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\resources.pak
Size 5.1MB
SHA256 66153f7b388503a9bab9df1fa157d3af88548bee264525694bca9a61ce3495e7
MD5 fb620332959ee6e46ac1c2a2f0e1b2d1
SHA1 eb18c735d187647c3c529932b8b80d9c9af09286
SHA512 1e5bfcac24a76ca8fae7b7fa5407f4eafeecfcda54726d66586f1171a7ba30cf76544d75aa44f1eb64b202e686ccd2c00c8cc0b24b249fc5c6c28c156cd03775
SSDEEP 98304:QefgvjXu82INBibFPzG/7DN7h1rA0Z0rwreQVnHbwJwKgoHksnR:QeIvuIzAq31hKi0kreS45JR
TLSH
T134463320E16C6D37D99E9779E4ACA1335734C9031891781CF4CD620E8F9D2EA16B93BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\v8_context_snapshot.bin
Size 471KB
SHA256 c16dcec41919a6d2850214f2275824be8a97d8c5e694e2ec8dd7d16ab2d5015c
MD5 031ea03da08fe1247280cfe781658791
SHA1 e91db50ad16b5a5fbbaf4118672d60b347ea6161
SHA512 b3d6f282761f8ab8760728ecb108f64741f6f3cd2a143813042ff63a3b6604fcfe7c1feabafb65f9f67906217edb5851f44605a34f7a50ed2058c25ce5efb30a
SSDEEP 6144:1jKA3pW4TRwsLj3spK0P8iWhyFUaxw/5h56N:R0G4f8i2yy/5h58
TLSH
T1E4A4952CB701FA22CC576EF049F1DA51F7B17E8CBA02110BB1DE5EAE11EAB852D57190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\vk_swiftshader.dll
Size 4.9MB
SHA256 c40fb9c7c7a2f6cf9342f0191f30d432ea7d05b78fce1c76d50a482b4c374c94
MD5 f4b601a307f24a90066cae7d0e1c634a
SHA1 ad3eeb414b8c0e13cbe1564bf2a9b2bd3794d450
SHA512 ba533e8fc665a27ffc5818a7d9664c8f85057d5395c250d7b1a94ef1c430707aec9b2835853c93268be47ca8e77324a7080cf3b17b919427579acd2394bda730
SSDEEP 49152:qGrnxGr9pGmj8pGtA/bVVku6KZlxsMOtVKOkc4FjHjAW3vZ1B93k1RE7SrLop8cJ:FnxY9NURayzxX61u0Lflb0wrD
TLSH
T1E9363903B295819AF05ED179475FA632E631FC811B7276DF42A02F192E3BBE06B39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\ExpanDrive\app-2026.2.9\vulkan-1.dll
Size 894KB
SHA256 14538eeeea0e2d9a9782ec79c386f16c7ba1d88f84312eb8e468edf1a885681c
MD5 91e2b8e763c329268903c5fb43aaa1e8
SHA1 96ebf71933792ac46d5f6fa4837eea5661a7cf21
SHA512 b677e583f6acba144cc41d1f04190d69a75d3579b4f77d710e10a0890af9c754d64d4eea20f40a1f2cba831852cfde5d44e2529e5088995ac8070e3c2449f3f8
SSDEEP 12288:UP1VNNJPqXu9D8xeLoCzG4JsZGS5ld/YlmQAuYvyRnsBsoj8XC29h:UPXJPq+9QeLpDpmQ/YJBseY9h
TLSH
T16E156D27AA944966D476C034C9828603CDB27C921725B5DF03685B19BF6BFF83B3CB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.betaId

Path C:\Users\Admin\AppData\Local\ExpanDrive\packages\.betaId
Size 39B
SHA256 df9f5fe56d3a9e8ba0144963343e620de18e6fa0929d67202868737855ec30a4
MD5 eca6abaa17443d2737eaf2a241942d41
SHA1 8d9ec3a07663fa3773c7a414c38407db5aa25cbf
SHA512 0cd15aeee661b249177de581493684efe7e3baf4e7af2ecafe4b7af2a8b7afaaafc39bbb2c84eb12a026f71a75bebd72a7ba823c2d72ae43684e83279d03ebab
MD5 SHA1 SHA512

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\ExpanDrive\packages\RELEASES
Size 84B
SHA256 1d0760bab7d8e71917c119f4b4c5fd682acca76b858954b3bb46069d71c54322
MD5 923aca06566e9b44d8f234160ca1df45
SHA1 7331d115d21e11646b87b521640c7a06bb86c30e
SHA512 acbe5d9b7355ec32c95a14dcd80ab3c965862c952ad2546a55fc2d0c013f994380a4a5be03522da81f8af565302c12112c734792be4d85a91f228a2a414a04f1
TLSH
T11EA012140401B4E208D35584020361108540194461F5204E19CB0362041510C5F90023
MD5 SHA1 SHA512 TLSH

Submit Download

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 81B
SHA256 191823756a587768045b59f78a47e3994cc424092b357c51639ea2440ac12d7e
MD5 9b3861beb6581d6bfdeddfb0881d1e68
SHA1 b4d29422fdb5762d29ce79bf62780d87af7b942a
SHA512 39d7770325287c159d58de5a24ee14c5732f47e86dc450b4b56e81475fe8fd78abc9c534bf410ff7a06cdba981b7612ba05e0d22ba35aa3a541ccbc029191b02
TLSH
T116A024140400F4F30CD355C403037110C5401D4471F1304F1DCF0371041500C5F50033
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.7MB
SHA256 19a9ed41a69c74f130f53572aa1b07b1fa35d93a408dcf9d3f16f0fd72dd1e69
MD5 4a5dbd3d6263eca75561a21b98aa4353
SHA1 9308061daf870e2c3b002c5b5ba81556c6e03873
SHA512 1741d133badccedeedc68079e1f6dcaf116bad58b85292031da2759ca0648416054d5806edcbf0910a276a95a76c4b21d2465dd1d994a068a1db5ee47632bd11
SSDEEP 24576:nh2mtSvdt2h7tDo4IFOtKhuqhju3hUjZtUagcR:nwlr2ptD5uuqY3hE
TLSH
T1C4856C11E7DC9E2BE9AE277AB475019813F2E6866372F74B2B0CA5792F933504C01763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 8KB
SHA256 4224d2ad8a24b0af7f8113c6a0b07405a8a3cf3fdcfe7a0b565f41129d4591d3
MD5 9d0033f0652ced49216ee79ee5d876f2
SHA1 38cd69a18dc584eb82e05e7ca4f71cd6cf81e82a
SHA512 a361b004e50b5f00adb9a506d3413cf6073e84d39c2c6764dae470f1849a468a698f7ed059bebec734181f08bee95a7c39e9c663ca9bfc94bdad28b918344094
SSDEEP 192:kjyXn4Inydiv36oQH12k2LnJx5Rk4i6BJfd9h+DUF5Ws:gIydmRQH1T2LJFBi6vzUs
TLSH
T17F02AE14830B5B1CFA3903F5B15E2A5DC9BFF425CB85226048E3EA238E3DF09A512543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e0983a1-fb8b-40ec-9670-059937d091a4.png

Path C:\Users\Admin\AppData\Local\Temp\2e0983a1-fb8b-40ec-9670-059937d091a4.png
Size 361KB
SHA256 43567eff7320b1a9d1c0eda0cfcfa36c35ec6085b85c2ea1b2f678947ac1ab6e
MD5 25f262a2ce77c809a9e5f37dcbc8f7a8
SHA1 a1fef68d0399da42cd66afb17676c32ffb98324f
SHA512 c42616b4ddf078121b47221aee7a3649b82c6a4d841ab21a438b7354e8e7360b2db8f0b60d2a9c7b8b9e819590708e0d6d96f480d9160f32137ad89891d8c318
SSDEEP 1536:+XbhVYuV+VDHzw9ChwqA0f+ArvgKPhfsti:2VzVUDHnR5fsti
TLSH
T1B774C548EBE5C3A2DAE708B7EDD7B7C4BA212EFAC852360624C4BF69D6331549407705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af8b68b8-83df-496e-9bf4-471980ed2c96.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\af8b68b8-83df-496e-9bf4-471980ed2c96.tmp.node
Size 691KB
SHA256 90e35de89ab5e5f9290e4ff1bbadcf221a82b2aa0d9b922187dc980adff3c831
MD5 c5c99144e2e1589628e14999ba59ad73
SHA1 9c80f8de6b5cdaf38677d5368b5287bacb9e465a
SHA512 0bcb99953397c6604d8e08bf2ba89248ee82f92436c2dcc779157b65227b0e1350927273a1b6d150a9db914d0a8830680df05ef651ee291b40657a3025a721c5
SSDEEP 12288:cRInDhSzUpqDDa2XX05VNpk4th460iQlp1Qk5wUFPcvKKR0JQQ8jKOx8:cOnDHpqnaskrdx
TLSH
T1EAE48E6637E811A6D0BBD13FC9978F59EAB1BC140720A7CB01D442A92E13BE85E3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbfsMntNtf6.dll

Path C:\Users\Admin\AppData\Local\Temp\cbfs6-ExpanDrive5\i386\cbfsMntNtf6.dll
Size 166KB
SHA256 3d4fa442019f89cd88711cfdcd0222b578dc67badd62d352915d15a327b8e7ca
MD5 48ad6c3829f8ca3c7fc2241883db315e
SHA1 fa8f83040111c30920b80540b49afed7c807ff93
SHA512 7bad05a02cbc74bf7f2ffa53fa1ff58f3b69293507e2f0d87f84b798c4eba069158a20f4dc8247b9bdc85aeccb55ad9d0acd75e7ed8df9d1a7238b7465ca79b2
SSDEEP 3072:Iol84dWScgNzhAybxked7WyR0fBXdQhq50ZKJ0gJ:Iol84dWSrYed7WykVCjK9
TLSH
T177F36B227740D073C58B643D0426E3666B3FBE309BA584C7BB683B6A5E707D25B3534A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbFsMntNtf6.dll

Path C:\Users\Admin\AppData\Local\Temp\cbfs6-ExpanDrive5\x64\CbFsMntNtf6.dll
Size 191KB
SHA256 64db72245147969bd67e05d79895bf12e5961410a4f91c10b03a60d91a2986b2
MD5 f8cd20c8574668abe42438ee8d80b48d
SHA1 a5453dc5909aa1943ee5e82ebbed1f3bea6e7346
SHA512 247af098d6856e7b2ec3f0813e8e59afaab6fc104a924439a10667382fa8cf42d29a7a5630d7a4558f88579a9c578339ca2054961319403936052674eda10453
SSDEEP 3072:VwcF+LBCOl7W32e8VCojm1CBgshRvD1ITxPIsePWmYD/Z5BgkODg1:qIOdU8j6CvRL1uA0D/iC
TLSH
T1F7146A56B36800B6D46BD138CDA39A46F6B2B8511B6093CF133487B91F37BE17A3A315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CbFsNetRdr6.dll

Path C:\Users\Admin\AppData\Local\Temp\cbfs6-ExpanDrive5\x64\CbFsNetRdr6.dll
Size 131KB
SHA256 506ee7744ec05bb8fe811e4a5787973fddb7a57a2937993255788e15cd8b1937
MD5 47f75204035c72e76be7be6bde35c1aa
SHA1 5966c75c415482c2b78d96b560e0c3e83b68f50a
SHA512 8d74144354b074f8c9c1500920f0e4211ee25d2d8aafa7a261e77b76b2fd675420a14ab478b9718cc7bdb49f230753ac7fd66a479b0e7baf8082b81fea96a11b
SSDEEP 3072:Qi+cU1xd+F9PfgQmv9gWl0UrWflkdfbeGdy2A45bGWpgL:fu1xd+3PCmA0YhdyGvAyGV
TLSH
T1FED36B9B739020B9E9ABD274C9B24527E77278050774938F0774868A5F33BE5BE3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\ExpanDrive\DawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\ExpanDrive\DawnCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\ExpanDrive\DawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\ExpanDrive\DawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\ExpanDrive\Network\Network Persistent State
Size 300B
SHA256 a959077b29b6af452381b991f0d98d3c5d32c581a33f7617bdf981005ab934b2
MD5 3a0b61249cc5986e66ffcee7ea24705a
SHA1 033c87ce922cd6987a57d2ed7fe693220bf8603b
SHA512 9bfdd571312a82212eff1043e27c8dbe5ca2f012333609ec9b9a54636cc8079b80fb63d2efc35270904ce98cf0c514709eab572753251821b950ade0fe7544f0
TLSH
T14DE07296C2E4ACBE0A9243F02B243913C2BE084952183E07C9E8AB1E83A18B8580044B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aec36.TMP

Path C:\Users\Admin\AppData\Roaming\ExpanDrive\Network\Network Persistent State~RFe5aec36.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

ExpanDrive.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ExpanDrive\ExpanDrive.lnk
Size 2KB
SHA256 695a97ce126ddcb23887ed0a13440058eb4ead93d08b7b6853e4f8e69f921c4c
MD5 1be47abcb5570c30a2cf60efddf6f21b
SHA1 35abfc83d26ad34a42967eec2bc2470d5c2b9a7e
SHA512 64ab9ecf379c01aff313c076aa239bd66078d2b9ee9c78b36621bf69b6d657a538b6ee1b5b3bb908f135108774f717e89eb062414551f10a0ade52e03f50e99b
TLSH
T13A41BB0BFECA2610FAFB86314AB2722185B8FCA1E1119F0C410881001EA7B5568E8E7F
MD5 SHA1 SHA512 TLSH

Submit Download

ExpanDrive.lnk

Path C:\Users\Admin\Desktop\ExpanDrive.lnk
Size 2KB
SHA256 d799437cd474d073bc8594f678e631e6df60d01c4d437179721f638992388ff1
MD5 e3a0147bb48c7bef6bed570564b97085
SHA1 72f1ed63d4cbdb2fb7234c6560eb1a52b85fa4ef
SHA512 1724fadaef5bcfd870e6bc858edf3d53aa9dae855a705285a34c9df5b25a5406d84c2808d81dd964ce0d6d796cb7df03eed0bacaf92e33c1e8afbfdb4913a061
TLSH
T13B418D17FECA1110EAFB86314EB3726185BCFCA1E6019E0C414481041DA3B556DA8E7F
MD5 SHA1 SHA512 TLSH

Submit Download

cbfs6.sys

Path C:\Windows\System32\drivers\cbfs6.sys
Size 450KB
SHA256 fd508ac5bf65f632554e7051e6ea8efa16898e630c5c101acdf32af1d8fc1972
MD5 740f3caacb3f4a0d51c87a96b962dd64
SHA1 3d116c1c053b65b40cfee6030dfdbee8f2700060
SHA512 a7b4f8f67437bd62cfce7522b1a00c2b101c8660694f3303e5dea20ec8b593c07318d1ee04536db50b7a3055ea7c35c12ee8ef073eb73fed9babefe8bba1389d
SSDEEP 6144:9BV8gykegZn4wFVfI4kOJ1inNoUDXqWh5lgPcoJ:9BVjycfgtIeJXDgt
TLSH
T175A47E9ADAE826A5C06EC5BAC273D55BFAF07C15172442DB43A0D7892B13BD0E53F312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4440-357-0x0000000004E90000-0x0000000004EB0000-memory.dmp

Download

memory/4568-371-0x000000000BA20000-0x000000000BAB2000-memory.dmp

Download

memory/4568-13-0x000000000B160000-0x000000000B19E000-memory.dmp

Download

memory/4568-14-0x000000000B140000-0x000000000B14E000-memory.dmp

Download

memory/4568-9-0x0000000000680000-0x0000000000844000-memory.dmp

Download

memory/4812-457-0x0000000000010000-0x0000000000085000-memory.dmp

Download

memory/5020-545-0x00000000057C0000-0x0000000005CEC000-memory.dmp

Download