Overview

overview

8

Static

static

1

NordInstaller.exe

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    169s
  • max time network
    172s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    12/10/2026, 17:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NordInstaller.exe
  • Size 11.6MB
  • Sample261012-wae2esvx3m
  • SHA256 c78c8e68178d6a418d427ab7d65bd47c2d30cb2247ea3d9f450a5d72d8ebeb08
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationransomwarespywaretrojanupx

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Modifies file permissions 1 TTPs 31 IoCs
    discovery
  • Unexpected DNS network traffic destination 64 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 40 IoCs
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 8 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 25 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: LoadsDriver 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 43 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\NordInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\NordInstaller.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c dotnet --list-runtimes
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • System Time Discovery
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Program Files\dotnet\dotnet.exe
        dotnet --list-runtimes
        3⤵
        • System Time Discovery
        PID:4056
    • C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\NordInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\NordInstaller.exe"
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c dotnet --list-runtimes
        3⤵
        • Executes a command shell one-liner
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:6048
        • C:\Program Files\dotnet\dotnet.exe
          dotnet --list-runtimes
          4⤵
          • System Time Discovery
          PID:5736
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c dotnet --list-runtimes
        3⤵
        • Executes a command shell one-liner
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:4344
        • C:\Program Files\dotnet\dotnet.exe
          dotnet --list-runtimes
          4⤵
          • System Time Discovery
          PID:2456
      • C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\vea4gv1k.g2r..exe
        "C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\vea4gv1k.g2r..exe" /SILENT /VERYSILENT /NORESTART
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Users\Admin\AppData\Local\Temp\is-GDIKM.tmp\vea4gv1k.g2r..tmp
          "C:\Users\Admin\AppData\Local\Temp\is-GDIKM.tmp\vea4gv1k.g2r..tmp" /SL5="$E006A,95494407,893440,C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\vea4gv1k.g2r..exe" /SILENT /VERYSILENT /NORESTART
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3212
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "cmdkey /delete:NordSecurityCenter/RenewToken"
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3608
            • C:\Windows\system32\cmdkey.exe
              cmdkey /delete:NordSecurityCenter/RenewToken
              6⤵
                PID:1824
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "cmdkey /delete:NSC-NordVPN/RenewToken"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2248
              • C:\Windows\system32\cmdkey.exe
                cmdkey /delete:NSC-NordVPN/RenewToken
                6⤵
                  PID:2492
              • C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\deldirrpa.exe
                "C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\deldirrpa.exe" -linksonly -skipoplocks C:\ProgramData\NordVPN
                5⤵
                • Executes dropped EXE
                PID:1096
              • C:\Program Files\dotnet\dotnet.exe
                "C:\Program Files\dotnet\dotnet.exe" --list-runtimes
                5⤵
                • System Time Discovery
                PID:6120
              • C:\Windows\SysWOW64\taskkill.exe
                "C:\Windows\system32\taskkill.exe" /f /im NordVPN.exe
                5⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4016
              • C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\NordUpdaterSetup.exe
                "C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\NordUpdaterSetup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /RESTARTEXITCODE=3010 /NOCLOSEAPPLICATIONS
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:388
                • C:\Users\Admin\AppData\Local\Temp\is-V35AB.tmp\NordUpdaterSetup.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-V35AB.tmp\NordUpdaterSetup.tmp" /SL5="$D002E,3497879,924160,C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\NordUpdaterSetup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /RESTARTEXITCODE=3010 /NOCLOSEAPPLICATIONS
                  6⤵
                  • Drops file in Program Files directory
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:5968
                  • C:\Users\Admin\AppData\Local\Temp\is-FKQJS.tmp\deldirrpa.exe
                    "C:\Users\Admin\AppData\Local\Temp\is-FKQJS.tmp\deldirrpa.exe" -skipoplocks -createnewC:\ProgramData\NordUpdater
                    7⤵
                    • Executes dropped EXE
                    PID:3656
                  • C:\Users\Admin\AppData\Local\Temp\is-FKQJS.tmp\_isetup\_setup64.tmp
                    helper 105 0x744
                    7⤵
                    • Executes dropped EXE
                    PID:5856
                  • C:\Windows\system32\icacls.exe
                    "C:\Windows\system32\icacls.exe" C:\ProgramData\NordUpdater /inheritance:d
                    7⤵
                    • Modifies file permissions
                    PID:5312
                  • C:\Windows\system32\icacls.exe
                    "C:\Windows\system32\icacls.exe" C:\ProgramData\NordUpdater /remove *S-1-5-32-545 /T
                    7⤵
                    • Modifies file permissions
                    PID:4524
                  • C:\Windows\system32\icacls.exe
                    "C:\Windows\system32\icacls.exe" C:\ProgramData\NordUpdater /grant *S-1-5-32-545:(RX)
                    7⤵
                    • Modifies file permissions
                    PID:4036
                  • C:\Windows\system32\icacls.exe
                    "C:\Windows\system32\icacls.exe" C:\ProgramData\NordUpdater\logs /grant *S-1-5-32-545:(OI)(CI)(RX)
                    7⤵
                    • Modifies file permissions
                    PID:3912
                  • C:\Windows\system32\icacls.exe
                    "C:\Windows\system32\icacls.exe" C:\ProgramData\NordUpdater\updates /grant *S-1-5-32-545:(OI)(CI)(RX)
                    7⤵
                    • Modifies file permissions
                    PID:1140
                  • C:\Windows\system32\icacls.exe
                    "C:\Windows\system32\icacls.exe" "C:\Program Files\NordUpdater" /inheritance:r
                    7⤵
                    • Modifies file permissions
                    PID:4072
                  • C:\Windows\system32\icacls.exe
                    "C:\Windows\system32\icacls.exe" "C:\Program Files\NordUpdater" /grant *S-1-5-32-545:(OI)(CI)(RX)
                    7⤵
                    • Modifies file permissions
                    PID:2832
                  • C:\Windows\system32\icacls.exe
                    "C:\Windows\system32\icacls.exe" "C:\Program Files\NordUpdater" /grant *S-1-5-32-544:(OI)(CI)(F)
                    7⤵
                    • Modifies file permissions
                    PID:728
                  • C:\Windows\system32\icacls.exe
                    "C:\Windows\system32\icacls.exe" "C:\Program Files\NordUpdater" /grant *S-1-5-18:(OI)(CI)(F)
                    7⤵
                    • Modifies file permissions
                    PID:3844
              • C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\vcredist2019_x64.exe
                "C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\vcredist2019_x64.exe" /repair /norestart /q ADMINDEPLOYMENT
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1096
                • C:\Windows\Temp\{79B0E228-B421-4269-A30E-CBED5097970E}\.cr\vcredist2019_x64.exe
                  "C:\Windows\Temp\{79B0E228-B421-4269-A30E-CBED5097970E}\.cr\vcredist2019_x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\vcredist2019_x64.exe" -burn.filehandle.attached=732 -burn.filehandle.self=736 /repair /norestart /q ADMINDEPLOYMENT
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:6124
                  • C:\Windows\Temp\{14F910E0-E477-4DE1-B631-F685A7BA245F}\.be\VC_redist.x64.exe
                    "C:\Windows\Temp\{14F910E0-E477-4DE1-B631-F685A7BA245F}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{3B88D251-7345-4DC7-9E70-291D29149EF0} {F5B7B7F6-CF57-4822-B7C2-20A621D47F6F} 6124
                    7⤵
                    • Adds Run key to start application
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:5812
                    • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                      "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1096 -burn.embedded BurnPipe.{BF1B1133-40EE-4826-9EE9-FCAB99B4825D} {34EB1547-6A43-4E76-B5EE-76251B2426C0} 5812
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2000
                      • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={d8bbe9f9-7c5b-42c6-b715-9ee898a2e515} -burn.filehandle.self=1096 -burn.embedded BurnPipe.{BF1B1133-40EE-4826-9EE9-FCAB99B4825D} {34EB1547-6A43-4E76-B5EE-76251B2426C0} 5812
                        9⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3780
                        • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                          "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A1C15425-FBD7-4152-8F33-92ABF5D98740} {7A553C83-55A8-425B-A467-F87A1A5FB78D} 3780
                          10⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          PID:1084
              • C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\_isetup\_setup64.tmp
                helper 105 0x90
                5⤵
                • Executes dropped EXE
                PID:5932
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN /inheritance:d
                5⤵
                • Modifies file permissions
                PID:4080
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN /remove *S-1-5-32-545 /T
                5⤵
                • Modifies file permissions
                PID:3820
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN /grant *S-1-5-32-545:(RX)
                5⤵
                • Modifies file permissions
                PID:5956
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN\logs /grant *S-1-5-32-545:(OI)(CI)(RX)
                5⤵
                • Modifies file permissions
                PID:2324
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN\updates /grant *S-1-5-32-545:(OI)(CI)(RX)
                5⤵
                • Modifies file permissions
                PID:6072
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN\settings /grant *S-1-5-32-545:(OI)(CI)(RX)
                5⤵
                • Modifies file permissions
                PID:3076
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" C:\ProgramData\NordVPN\affiliates.json /grant *S-1-5-32-545:(RX)
                5⤵
                • Modifies file permissions
                PID:4676
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\Program Files\NordVPN" /inheritance:r
                5⤵
                • Modifies file permissions
                PID:1840
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\Program Files\NordVPN" /grant *S-1-5-32-545:(OI)(CI)(RX)
                5⤵
                • Modifies file permissions
                PID:4948
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\Program Files\NordVPN" /grant *S-1-5-32-544:(OI)(CI)(F)
                5⤵
                • Modifies file permissions
                PID:2512
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\Program Files\NordVPN" /grant *S-1-5-18:(OI)(CI)(F)
                5⤵
                • Modifies file permissions
                PID:5924
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\Analytics\NordVPN.db" /grant *S-1-5-32-545:(W)
                5⤵
                • Modifies file permissions
                PID:5808
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\Analytics\NordVPN.db-journal" /grant *S-1-5-32-545:(W)
                5⤵
                • Modifies file permissions
                PID:4968
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\ThreatProtection" /inheritance:r
                5⤵
                • Modifies file permissions
                PID:3744
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\ThreatProtection" /remove *S-1-5-32-545 /T
                5⤵
                • Modifies file permissions
                PID:6000
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\ThreatProtection" /grant *S-1-5-32-544:(OI)(CI)(F)
                5⤵
                • Modifies file permissions
                PID:1208
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\ThreatProtection" /grant *S-1-5-18:(OI)(CI)(F)
                5⤵
                • Modifies file permissions
                PID:5036
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\ThreatProtection\Settings" /grant *S-1-5-32-545:(OI)(CI)(RX)
                5⤵
                • Modifies file permissions
                PID:5936
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\NordGuardian" /inheritance:r
                5⤵
                • Modifies file permissions
                PID:5604
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\NordGuardian" /remove *S-1-5-32-545 /T
                5⤵
                • Modifies file permissions
                PID:4940
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\NordGuardian" /grant *S-1-5-32-544:(OI)(CI)(F)
                5⤵
                • Modifies file permissions
                PID:4772
              • C:\Windows\system32\icacls.exe
                "C:\Windows\system32\icacls.exe" "C:\ProgramData\NordVPN\NordGuardian" /grant *S-1-5-18:(OI)(CI)(F)
                5⤵
                • Modifies file permissions
                PID:396
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe" C:\Program Files\NordVPN\NordVPN.exe
            3⤵
              PID:1092
        • C:\Program Files\NordUpdater\NordUpdateService.exe
          "C:\Program Files\NordUpdater\NordUpdateService.exe"
          1⤵
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5548
        • C:\Program Files\NordUpdater\NordUpdateService.exe
          "C:\Program Files\NordUpdater\NordUpdateService.exe"
          1⤵
          • Drops file in System32 directory
          • Executes dropped EXE
          • Reads the TCP/IP host and domain name from the registry
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          PID:5552
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:5352
        • C:\Windows\system32\srtasks.exe
          C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3216
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1856
        • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
          "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /burn.runonce
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1916
          • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
            "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261012184351.log" ADMINDEPLOYMENT
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1988
            • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -burn.filehandle.attached=548 -burn.filehandle.self=564 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20261012184351.log" ADMINDEPLOYMENT
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4364
              • C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{d8bbe9f9-7c5b-42c6-b715-9ee898a2e515}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{7B6E79F0-469D-40AA-964B-A3B0655F7906} {28C2FD24-4A11-4CB2-992A-BEFBCFDAFCF2} 4364
                4⤵
                • Adds Run key to start application
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:2588
        • C:\Program Files\NordVPN\nordvpn-service.exe
          "C:\Program Files\NordVPN\nordvpn-service.exe"
          1⤵
          • Unexpected DNS network traffic destination
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4988
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe" /C pnputil /add-driver "C:\Program Files\NordVPN\8.13.1.0\Drivers\Win11\ovpn-dco.inf" /install
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1312
            • C:\Windows\system32\pnputil.exe
              pnputil /add-driver "C:\Program Files\NordVPN\8.13.1.0\Drivers\Win11\ovpn-dco.inf" /install
              3⤵
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              PID:4896
          • C:\Program Files\NordVPN\8.13.1.0\Drivers\tapctl.exe
            "C:\Program Files\NordVPN\8.13.1.0\Drivers/tapctl.exe" list --hwid ovpn-dco
            2⤵
            • Executes dropped EXE
            PID:1804
          • C:\Program Files\NordVPN\8.13.1.0\Drivers\tapctl.exe
            "C:\Program Files\NordVPN\8.13.1.0\Drivers/tapctl.exe" create --name "OpenVPN Data Channel Offload for NordVPN" --hwid ovpn-dco
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Executes dropped EXE
            PID:3132
            • C:\Windows\SYSTEM32\netsh.exe
              netsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload for NordVPN"
              3⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:852
          • C:\Windows\SYSTEM32\netsh.exe
            "netsh" interface ip set address name="11" source=static address=10.5.0.2 mask=255.255.0.0
            2⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3404
        • C:\Program Files\NordVPN\NordSec ThreatProtection\nordsec-threatprotection-service.exe
          "C:\Program Files\NordVPN\NordSec ThreatProtection\nordsec-threatprotection-service.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          PID:652
        • C:\Program Files\NordVPN\8.13.1.0\Drivers\NDivert.sys
          "C:\Program Files\NordVPN\8.13.1.0\Drivers\NDivert.sys"
          1⤵
          • Executes dropped EXE
          PID:5972
        • C:\Windows\system32\dllhost.exe
          C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
          1⤵
          • Drops file in Windows directory
          PID:5772
        • C:\Windows\System32\msdtc.exe
          C:\Windows\System32\msdtc.exe
          1⤵
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          PID:5732
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
          1⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of WriteProcessMemory
          PID:3352
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Windows\TEMP\{6a1cfbf5-886e-ec44-bd0b-18b4756d1b2d}\ovpn-dco.inf" "9" "4649feacb" "0000000000000150" "Service-0x0-3e7$\Default" "00000000000000FC" "208" "C:\Program Files\NordVPN\8.13.1.0\Drivers\Win11"
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:3936
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "9" "C:\Windows\Temp\a9dd59a1a5736d0351697b3b90858cfd54cee858ca2cc057644b67c3bcdaf7e8\wireguard.inf" "9" "4d2e6d467" "0000000000000164" "Service-0x0-3e7$\Default" "00000000000000C0" "208" "C:\Windows\Temp\a9dd59a1a5736d0351697b3b90858cfd54cee858ca2cc057644b67c3bcdaf7e8"
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:5100
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "2" "1" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.3.3.0:ovpn-dco," "42b53aaff" "0000000000000148" "91d2"
            2⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            PID:4052
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "1" "0" "SWD\WireGuard\{FC01FCD5-2B9D-2FD8-78D8-CB78B313E2B2}" "" "" "497127a3f" "0000000000000000" "91d2"
            2⤵
            • Drops file in Drivers directory
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            PID:3444
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
          1⤵
          • Modifies data under HKEY_USERS
          PID:5780
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
          1⤵
            PID:2268
            • C:\Program Files\NordVPN\NordVPN.exe
              "C:\Program Files\NordVPN\NordVPN.exe"
              2⤵
              • Unexpected DNS network traffic destination
              • Adds Run key to start application
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:3248
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://napps-1.com/v1/users/oauth/login-redirect?attempt=ec38f585-adbe-45ff-90da-09ef858d96de&nord_origin=nordvpn_windows&utm_source=windows&utm_medium=in-app&utm_campaign=desktop-app
                3⤵
                • Enumerates system info in registry
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                PID:6076
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2dc,0x2e0,0x2e4,0x2d8,0x364,0x7ffea4ebc188,0x7ffea4ebc194,0x7ffea4ebc1a0
                  4⤵
                    PID:2624
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,2043233687541339877,2250024000356676087,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
                    4⤵
                    • System Time Discovery
                    PID:3684
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,9232831875664224925,16592306241377932621,262144 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
                    4⤵
                      PID:6148
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,70353141326811046,2295973839374670152,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
                      4⤵
                        PID:6188
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,15937893921016002500,3479231593117095634,2097152 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                        4⤵
                          PID:6404
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,6759210719435378343,7699019770422607385,2097152 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
                          4⤵
                            PID:6412
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,5370018208159486385,14329782265522053932,2097152 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
                            4⤵
                              PID:6528
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,8078833022113426163,2192754373994933838,2097152 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:9
                              4⤵
                                PID:6536
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4248,i,6120700196775701304,6409488766746148367,2097152 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
                                4⤵
                                  PID:6544
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4260,i,1249974134398168273,17556234448253102759,2097152 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
                                  4⤵
                                    PID:6552
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,8706851509516410482,653035302724393683,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
                                    4⤵
                                      PID:6816
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,15698328711059650951,16223188362193947673,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
                                      4⤵
                                        PID:6764
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,3645520776740177299,5451740518036989483,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
                                        4⤵
                                          PID:6780
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5876,i,15091688062069988710,5345857247010182160,2097152 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
                                          4⤵
                                            PID:6840
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,3065539827233019911,13344980849026942163,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
                                            4⤵
                                              PID:6932
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,3065539827233019911,13344980849026942163,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
                                              4⤵
                                                PID:6924
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,11002843311355936455,10113968451898474110,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
                                                4⤵
                                                  PID:7108
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                    cookie_exporter.exe --cookie-json=1128
                                                    5⤵
                                                      PID:6268
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,11189544322713193087,9836523170622410238,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:14
                                                    4⤵
                                                      PID:1796
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,9222004376591921152,9155988338834184897,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
                                                      4⤵
                                                        PID:4972
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,9191725883040380158,14352574072828959860,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
                                                        4⤵
                                                          PID:5500
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,12612626489793621460,14229832008116058762,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
                                                          4⤵
                                                            PID:6740
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,707685297413080206,18298048553163686965,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
                                                            4⤵
                                                              PID:6408
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,10096096322527465247,14422502957410608164,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
                                                              4⤵
                                                                PID:6972
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,3145277445663478109,14244419358496931372,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
                                                                4⤵
                                                                  PID:5368
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,6560866642156172425,15821827909495185622,524288 --field-trial-handle=2192,i,10437697634408220159,13133071325937274357,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
                                                                  4⤵
                                                                    PID:4524
                                                            • C:\Program Files\NordVPN\NordVPN.exe
                                                              "C:\Program Files\NordVPN\NordVPN.exe" --auto-start
                                                              1⤵
                                                              • Executes dropped EXE
                                                              PID:5404
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                              1⤵
                                                                PID:6248
                                                              • C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\mshield.sys
                                                                "C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\mshield.sys"
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:6808
                                                              • C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\travis.sys
                                                                "C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\travis.sys"
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:7072
                                                              • C:\Windows\system32\taskmgr.exe
                                                                "C:\Windows\system32\taskmgr.exe" /0
                                                                1⤵
                                                                • Checks SCSI registry key(s)
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:5620

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Command and Scripting Interpreter

                                                                    1
                                                                    T1059

                                                                    Windows Command Shell

                                                                    1
                                                                    T1059.003

                                                                    Persistence

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1547.001

                                                                    Event Triggered Execution

                                                                    2
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Netsh Helper DLL

                                                                    1
                                                                    T1546.007

                                                                    Privilege Escalation

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1547.001

                                                                    Event Triggered Execution

                                                                    2
                                                                    T1546

                                                                    Component Object Model Hijacking

                                                                    1
                                                                    T1546.015

                                                                    Netsh Helper DLL

                                                                    1
                                                                    T1546.007

                                                                    Defense Evasion

                                                                    File and Directory Permissions Modification

                                                                    1
                                                                    T1222

                                                                    Modify Registry

                                                                    2
                                                                    T1112

                                                                    Subvert Trust Controls

                                                                    1
                                                                    T1553

                                                                    Install Root Certificate

                                                                    1
                                                                    T1553.004

                                                                    Credential Access

                                                                    Discovery

                                                                    Browser Information Discovery

                                                                    1
                                                                    T1217

                                                                    Peripheral Device Discovery

                                                                    2
                                                                    T1120

                                                                    Query Registry

                                                                    6
                                                                    T1012

                                                                    System Information Discovery

                                                                    5
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    System Network Configuration Discovery

                                                                    1
                                                                    T1016

                                                                    System Time Discovery

                                                                    1
                                                                    T1124

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    e5997c7.rbs
                                                                    • Path C:\Config.Msi\e5997c7.rbs
                                                                    • Size 19KB
                                                                    • SHA256 cecb00fcb9f97cda01e5a74471252a3fd83efb0b284c5e0c042da1ce6101877f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    e5997d3.rbs
                                                                    • Path C:\Config.Msi\e5997d3.rbs
                                                                    • Size 19KB
                                                                    • SHA256 a8b81c234fbd58347d2a1161e1f746b376237413e238ee06d6a5439c206456af
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    e5997da.rbs
                                                                    • Path C:\Config.Msi\e5997da.rbs
                                                                    • Size 21KB
                                                                    • SHA256 9e9a6949c7015af94984a8f33923d857095048d0b4c860b4ccd9a02d17a8d568
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    e5997e9.rbs
                                                                    • Path C:\Config.Msi\e5997e9.rbs
                                                                    • Size 21KB
                                                                    • SHA256 d1e861e953c50208f2709bace7f02e2bf3b606e19dcf30550d6a66a9c79284fe
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-2133J.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Drivers\is-2133J.tmp
                                                                    • Size 7KB
                                                                    • SHA256 cec16cf495c3e9257849bdcf87c9cfc6a9472c326fea18f3d222062cbd0ba2f8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-HSLSB.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Drivers\is-HSLSB.tmp
                                                                    • Size 23KB
                                                                    • SHA256 aaf320f6679da48cd331d393231762efd28b46544f38f1de953dd0718b941e8a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-JM46B.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Drivers\is-JM46B.tmp
                                                                    • Size 51KB
                                                                    • SHA256 90935f8fcb9be449c07082d450ea6c9bcc48ba05c59f39a151455f776ebe1375
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-RJQ16.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Drivers\is-RJQ16.tmp
                                                                    • Size 289KB
                                                                    • SHA256 4e1c9b2aeed75169fed95fbe6818ef4896a519eb7a11c690541ef98ffaa82435
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-B8792.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Drivers\win10\is-B8792.tmp
                                                                    • Size 97KB
                                                                    • SHA256 1e4ec5ee85c6d79bc30f1ea5819d9c8a92373a5057f5ef908164bca7afe46247
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-MKLL9.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Drivers\win10\is-MKLL9.tmp
                                                                    • Size 11KB
                                                                    • SHA256 b9402d5ec68576f138cf94d3d945b26d427dda5140bedfb4bcef120409176c96
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-NUOU3.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Drivers\win11\is-NUOU3.tmp
                                                                    • Size 11KB
                                                                    • SHA256 b125d014ddaaede22981bbac1b4f222f4a7a700ad339235016d67086b3b074d6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-U4APU.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Drivers\win11\is-U4APU.tmp
                                                                    • Size 98KB
                                                                    • SHA256 53fa831f2914723383e9925d5f6d8a116e75046722b750dcb9efe02bdcd6d199
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Configuration.Binder.dll
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Microsoft.Extensions.Configuration.Binder.dll
                                                                    • Size 41KB
                                                                    • SHA256 5a47750f5c8eb91a203a743abbdc27c7feceeb2218d39445df6560629477eec9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Configuration.dll
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Microsoft.Extensions.Configuration.dll
                                                                    • Size 42KB
                                                                    • SHA256 b5cd9da2c3364a5b201cecb0c80e25227d27ba44d96343d2894ff8ef3fd81550
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Diagnostics.Abstractions.dll
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Microsoft.Extensions.Diagnostics.Abstractions.dll
                                                                    • Size 29KB
                                                                    • SHA256 9864dbcfdbfe395bbd64deec7568fdaf0cbc3850f0cd8f53e7359189bd158082
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Diagnostics.dll
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Microsoft.Extensions.Diagnostics.dll
                                                                    • Size 34KB
                                                                    • SHA256 31e08b4e0018ee136d65dfcca8f655a1a74cf8841e6029044c99b2e75d5f59f0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Http.dll
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Microsoft.Extensions.Http.dll
                                                                    • Size 86KB
                                                                    • SHA256 c1133578dae376c51335ce9e0b800c666a06f5aafe5b6b23a2706c7025b087a9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Options.ConfigurationExtensions.dll
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Microsoft.Extensions.Options.ConfigurationExtensions.dll
                                                                    • Size 22KB
                                                                    • SHA256 b9ea7bb70bfecf5c649f2559300fce232729257cfdb4221dc96f1ea778227353
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-ACVMK.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Modules\ThreatProtection\is-ACVMK.tmp
                                                                    • Size 516KB
                                                                    • SHA256 bcf3a14e8712a90837fc5c0d8c8a24696af2bd7f74e9767597ec81ededfb23db
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-J0CJU.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Modules\ThreatProtection\is-J0CJU.tmp
                                                                    • Size 217KB
                                                                    • SHA256 f7f50017ca9f457b854498358ae595c2a8ab69c1fd8b915139d22bed8f7e4f2a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-Q48O2.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Modules\ThreatProtection\is-Q48O2.tmp
                                                                    • Size 281KB
                                                                    • SHA256 cecb78ee944fd7cd1889c21602cc905df8f72af06a3798fb0fd75d96d436891e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    template.xslt
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Resources\templates\template.xslt
                                                                    • Size 3KB
                                                                    • SHA256 d6ed263761188a215ce302b69fe0b73b6dc796f5935206c56d2f9e1694c00635
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    template_v2.xslt
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Resources\templates\template_v2.xslt
                                                                    • Size 3KB
                                                                    • SHA256 2dd81bd8d79797f2d00abdbb3800a69a89425a7eb49d7c1346e2b72eb0da2f97
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    xor_template.xslt
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Resources\templates\xor_template.xslt
                                                                    • Size 4KB
                                                                    • SHA256 56c2e8781f54a083aa5a3b19b8e018ab96917e0bfe79be8593161f2f2954276c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    toast.ico
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\Resources\toast.ico
                                                                    • Size 100KB
                                                                    • SHA256 5e1d4775cf88be54e26ffde27efa16e4bd6c325873770f26f14ee2b5f2e2902e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-1VQFP.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-1VQFP.tmp
                                                                    • Size 22KB
                                                                    • SHA256 1c41b4ba453d20f841496baf3d37096c65e296f506add1cc37e3859438804aa2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-2N0G6.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-2N0G6.tmp
                                                                    • Size 376KB
                                                                    • SHA256 325d020810ee60d28b8292eaa282bf21c6ccb202c96a8367c7b9f6ce237e1a03
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-3V9M9.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-3V9M9.tmp
                                                                    • Size 1002KB
                                                                    • SHA256 d3d8a8e35cb6cd2bac3bac85c2c3a7557aa82e6cec20b4945d147b7527342d99
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-3VFTV.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-3VFTV.tmp
                                                                    • Size 811KB
                                                                    • SHA256 57761772295d9717a84091e5128b9f60f1bae7434afa93ffe6e1b517c3481f58
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-4CB69.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-4CB69.tmp
                                                                    • Size 90KB
                                                                    • SHA256 691a2782ff79a868d5f15144f0d7ac0a4e8cd0640698d4724b178b8b718b0ea1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-4TBOV.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-4TBOV.tmp
                                                                    • Size 179KB
                                                                    • SHA256 31aea13b3af899ccee2f4e97cad38174356eab3501974473a00e9d83048c2110
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-51LVD.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-51LVD.tmp
                                                                    • Size 154KB
                                                                    • SHA256 ef675cf5c7e0e4ba6291e4644d3ceba378ce9685eb179c6afa8f0bf8f9cadc32
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-55RM3.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-55RM3.tmp
                                                                    • Size 48KB
                                                                    • SHA256 85b3aa602ea75b52031f640c2854897eacf08a36fbd4a490fe954242639e5846
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-5HJ3M.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-5HJ3M.tmp
                                                                    • Size 18KB
                                                                    • SHA256 136d5965cf4768e8420b547a8bddea882921f426c371833d558a858a2f0c235a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-7IC9O.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-7IC9O.tmp
                                                                    • Size 22KB
                                                                    • SHA256 9ba3a0e63c793cd63910882f6458e6e23fbb35d7a424f02fa8659eb8515b0b7e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-7UOLM.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-7UOLM.tmp
                                                                    • Size 669KB
                                                                    • SHA256 d156c5349bce411159affaa1369ee2bbac3d4cba7793bcedaf9c85f9c9fb5839
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-9L23B.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-9L23B.tmp
                                                                    • Size 17KB
                                                                    • SHA256 d557f54112db1b908bb0f15cae688204420c8a76413085e33dd8a18fd8ce097b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-B0KMP.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-B0KMP.tmp
                                                                    • Size 122KB
                                                                    • SHA256 50557f6674bc1570308b3f326ae7b6b72839cc9bbac8934ab16ff563178d28f9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-BUREL.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-BUREL.tmp
                                                                    • Size 81KB
                                                                    • SHA256 ee33f9daab2b1be6419798557e4733c6aca958d8f6672978cf8a6f2148aaead2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-DCJ90.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-DCJ90.tmp
                                                                    • Size 224KB
                                                                    • SHA256 22ebbcacd1f527a44efdced34fa8865024cfe552f23098f760f884964be6167d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-DLPQ4.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-DLPQ4.tmp
                                                                    • Size 276KB
                                                                    • SHA256 3f028698fa944c207c20baa4f47e7376f4d5c0333e7fa7f88d16ea0c8c460272
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-E1TU8.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-E1TU8.tmp
                                                                    • Size 139KB
                                                                    • SHA256 12375e18448bb426c9ea6aac74a0c0e2dad2f70fce38cef96dd37c52bc12b1c7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-E29EM.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-E29EM.tmp
                                                                    • Size 289KB
                                                                    • SHA256 2e7ad1661c1b238813b025baabc4cb44cb5bf5b905e787cef7015ea456281708
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-E8TEK.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-E8TEK.tmp
                                                                    • Size 218KB
                                                                    • SHA256 b8ae86cc24374f00f5e7c54e0c049980a5d0140e47207a1fe69cfffde9219aff
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-EH6IG.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-EH6IG.tmp
                                                                    • Size 282KB
                                                                    • SHA256 daa980f857f67f0c501eaac5e58a70fb10b77a1f28bb7c89ab60ab9985a50a61
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-FCMIT.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-FCMIT.tmp
                                                                    • Size 380KB
                                                                    • SHA256 df4d8e1d3616e116c450f751a631234163f526257a0141b47f4c0810326998fa
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-G16B9.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-G16B9.tmp
                                                                    • Size 171KB
                                                                    • SHA256 362e7140d7cea4774ad66be5daaee1bfc1e6313265761fe01b25b1b69b3f7859
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-GF93D.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-GF93D.tmp
                                                                    • Size 2.6MB
                                                                    • SHA256 db8de1773f2a08dd456e481702629a6a8a49ce73d9c023d27e893c4547edf5d6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-GL5OJ.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-GL5OJ.tmp
                                                                    • Size 24KB
                                                                    • SHA256 49624a49e5e93bb9e0f67d53b5f800df1639a96b6c499b4702ca2400036e1017
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-I9GFS.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-I9GFS.tmp
                                                                    • Size 15KB
                                                                    • SHA256 9176ab9d413a02065eaf3cbc2cc8f3b9a7828bb42eeb60f0e94f4c62e90c37cc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-JLJ70.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-JLJ70.tmp
                                                                    • Size 142KB
                                                                    • SHA256 6c7d41d7cbf5284e245c721be6d640fafe72f6f917606cb5d013c55e14b16d3a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-JUA8O.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-JUA8O.tmp
                                                                    • Size 27KB
                                                                    • SHA256 9bee4e35576355156f00e2e47ef57aa2c8ca64390c112f083a772f2219026293
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-KB8ED.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-KB8ED.tmp
                                                                    • Size 295KB
                                                                    • SHA256 64b741bd71895489e2d48d2848b812b39e1c0c3a63ab4c72384e82f73d2eef38
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-L0E1E.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-L0E1E.tmp
                                                                    • Size 16KB
                                                                    • SHA256 4b42f2d27aee9fdc2063709b485d052bf46c387e6a6e13ce92adebd5a5fad2d4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-LAV6V.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-LAV6V.tmp
                                                                    • Size 27KB
                                                                    • SHA256 e6b409570b35e7f469b3e3941cf5d9870b7924085196400de4d79c569de0ab59
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-LELB5.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-LELB5.tmp
                                                                    • Size 61KB
                                                                    • SHA256 8ef9bdc46fbd185c0c0ee13cb39a8806e70991281993182d737d011f731526b9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-NL2NI.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-NL2NI.tmp
                                                                    • Size 2.8MB
                                                                    • SHA256 0662c67ffa3927d56029d212d9bb3608c667da96c2283cfe2f869e0376806d6a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-NTOGQ.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-NTOGQ.tmp
                                                                    • Size 85KB
                                                                    • SHA256 8d6c9b2bffe01741d1b4915fe26c93ba8c2382b00ee4cf88a312a789619ef503
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-OKAMN.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-OKAMN.tmp
                                                                    • Size 304KB
                                                                    • SHA256 b2d6e7e991dc9ef154b29f4966f04fd8ed4ebb2c1d1242ea1d5f3e90f8ae5143
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-Q6A0A.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-Q6A0A.tmp
                                                                    • Size 567KB
                                                                    • SHA256 72ec82cee06d40c7fd992d22c7621fcb1310961a5b140a606f693d83abe8ba87
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-QOL37.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-QOL37.tmp
                                                                    • Size 21KB
                                                                    • SHA256 f08b1f597abb3647ab6e844282ded763e6078dbef6dd54b9d956ca419fac42fe
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-R6ES0.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-R6ES0.tmp
                                                                    • Size 156KB
                                                                    • SHA256 39d587181806b2bbd04da9d22568c4e2f1aa78721cf3214726a591b514f2b442
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-ROSSR.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-ROSSR.tmp
                                                                    • Size 117KB
                                                                    • SHA256 48e7a84c1c129227ce1cff4293d5d5e9c700787d86c4581aa25fad8ff14bb7fe
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-S9PCJ.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-S9PCJ.tmp
                                                                    • Size 336KB
                                                                    • SHA256 016c423e7ec2a11aa2da4a90d90c6fb9f2801b39da2746eb9d6dba5cf9e82a79
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-SSINE.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-SSINE.tmp
                                                                    • Size 16KB
                                                                    • SHA256 85a119b89001676c28c31b50db7f2479c90d2158619925084ac600839f31189a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-V0FGC.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-V0FGC.tmp
                                                                    • Size 6.1MB
                                                                    • SHA256 b3bbb8fac5ff737dca1f2041b450d0cd1039d7445431ef90a335dfdcdc992533
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-V4FVK.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-V4FVK.tmp
                                                                    • Size 287KB
                                                                    • SHA256 82260fef3a01a429ab525a75765f263cb54c5fd01abb87a0a4dab15bfae6fc37
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-VQOG3.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-VQOG3.tmp
                                                                    • Size 376KB
                                                                    • SHA256 9a6fc857975a2a18062892b0a41a1ef111bd0ba3dd4a662adaf7ed619bd984d5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-VU27I.tmp
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\is-VU27I.tmp
                                                                    • Size 7.2MB
                                                                    • SHA256 70e064bc9e40a5e298cad4a6fbda0c29953449089b335fa317f8f1b8ec7f6328
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    nudler.dll
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\nudler.dll
                                                                    • Size 333KB
                                                                    • SHA256 dae7630ba7738a9a4ddc4d2de1762a56bc3ffb112e5dd29744731697151b6d87
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    telio.dll
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\telio.dll
                                                                    • Size 13.3MB
                                                                    • SHA256 b9be1a460516b40183b62f2c6156afe67379b464a7a2ac7a9f3e74b6c90dd339
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    wireguard.dll
                                                                    • Path C:\Program Files\NordVPN\8.13.1.0\wireguard.dll
                                                                    • Size 1.3MB
                                                                    • SHA256 d2ad6ce25634776f5067fd9d5750a5e3d2add1adde98eb1f56a2df194d0e9cbb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-AS09T.tmp
                                                                    • Path C:\Program Files\NordVPN\Diagnostics\Drivers\win11\is-AS09T.tmp
                                                                    • Size 2KB
                                                                    • SHA256 74e705063afb0b0c28c5ea48ac38c59112a1795c1efae0fb03bdc1262cdec5fd
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Configuration.Abstractions.dll
                                                                    • Path C:\Program Files\NordVPN\Diagnostics\Microsoft.Extensions.Configuration.Abstractions.dll
                                                                    • Size 27KB
                                                                    • SHA256 fefcdb267a73099cb90e5af56b5ef2bca59bed974339b3a6810352bde23537a6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.DependencyInjection.Abstractions.dll
                                                                    • Path C:\Program Files\NordVPN\Diagnostics\Microsoft.Extensions.DependencyInjection.Abstractions.dll
                                                                    • Size 62KB
                                                                    • SHA256 67fa4325000db017dc0c35829b416f024f042d24efb868bcf17a895ee6500a93
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Logging.Abstractions.dll
                                                                    • Path C:\Program Files\NordVPN\Diagnostics\Microsoft.Extensions.Logging.Abstractions.dll
                                                                    • Size 63KB
                                                                    • SHA256 bb853130f5afaf335be7858d661f8212ec653835100f5a4e3aa2c66a4d4f685d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Primitives.dll
                                                                    • Path C:\Program Files\NordVPN\Diagnostics\Microsoft.Extensions.Primitives.dll
                                                                    • Size 42KB
                                                                    • SHA256 446ff16e903e7479558816e213a3adee9a1c1adad65a56d853801b10933e29d7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.NordVpn.DiagnosticsTool.Application.exe
                                                                    • Path C:\Program Files\NordVPN\Diagnostics\NordSecurity.NordVpn.DiagnosticsTool.Application.exe
                                                                    • Size 284KB
                                                                    • SHA256 2e3eefcc4bdc105c8a83be8afc8e7471c01732cfbbe12172d3f72e3e40a220c0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-ARLUP.tmp
                                                                    • Path C:\Program Files\NordVPN\Diagnostics\is-ARLUP.tmp
                                                                    • Size 496B
                                                                    • SHA256 b7ab6a0ad18cf1280ad75c8e6d0df62d06c84d62dc69351e49c04afd3e218eb2
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    is-00CP7.tmp
                                                                    • Path C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\is-00CP7.tmp
                                                                    • Size 29KB
                                                                    • SHA256 bea3cf225599b05a521902e12e23de6a2309937dfb3763ccd2cea62ad2c4fe37
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-1H1SD.tmp
                                                                    • Path C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\is-1H1SD.tmp
                                                                    • Size 85KB
                                                                    • SHA256 46328ad334942a6f2b0fd331ee632f06c51eefb2a7ba18ffe264513847e9c3bd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-1SEK0.tmp
                                                                    • Path C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\is-1SEK0.tmp
                                                                    • Size 132KB
                                                                    • SHA256 7017465d6f7cde792bad23b79bd848a6c2586b0bfe5cdf1371ab9838732d9a8b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-CFNAS.tmp
                                                                    • Path C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\is-CFNAS.tmp
                                                                    • Size 26KB
                                                                    • SHA256 15e1262880f263806a2808d750688739662323b20ccd9835222fff8c30899a4a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-EDF8C.tmp
                                                                    • Path C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\is-EDF8C.tmp
                                                                    • Size 43KB
                                                                    • SHA256 9f67076c79a953f5068c0792114f9722527cfa17ed7414c73fd14833bfe59918
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-FCA49.tmp
                                                                    • Path C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\is-FCA49.tmp
                                                                    • Size 44KB
                                                                    • SHA256 ed0855b522f09b5a9ddbb85de62042c25e07d10044086da8620c845de41e473c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-G1G8J.tmp
                                                                    • Path C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\is-G1G8J.tmp
                                                                    • Size 432KB
                                                                    • SHA256 f7ea3a9618aca48fb57fd06e9102b327ab66468ceb78c96d56f7d2eee2945983
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-IKS24.tmp
                                                                    • Path C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\is-IKS24.tmp
                                                                    • Size 50KB
                                                                    • SHA256 1765c6147ed43b7ce3c0e98db3367791a3821def124775015bdce6278f9295c5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-Q3I6J.tmp
                                                                    • Path C:\Program Files\NordVPN\NordSec ThreatProtection\8.13.6.0\is-Q3I6J.tmp
                                                                    • Size 27KB
                                                                    • SHA256 acf5896d0f34fa1a43295797584b3805c24743ce25ee87538eeec83b012bbf4f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordVPN.exe
                                                                    • Path C:\Program Files\NordVPN\NordVPN.exe
                                                                    • Size 574KB
                                                                    • SHA256 fae2e6d023c7054fa00ac9404ab874ad9d6d1884751cfdabe0adfa7a15dcf721
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    AbTests.json
                                                                    • Path C:\ProgramData\NordVPN\FeatureConfigs\AbTests.json
                                                                    • Size 1KB
                                                                    • SHA256 56b5106a32b78b5ffdeb5b163b923d67f43b215aeca4fad08662283accfd683b
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    Connection.json
                                                                    • Path C:\ProgramData\NordVPN\FeatureConfigs\Connection.json
                                                                    • Size 8KB
                                                                    • SHA256 4ac71850345184f0bb430b91ad2e04d1ad77b942fab5baf869f0af51c2d04e88
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    LibmooseEventsToggle.json
                                                                    • Path C:\ProgramData\NordVPN\FeatureConfigs\LibmooseEventsToggle.json
                                                                    • Size 2KB
                                                                    • SHA256 ff8eabc52d69bab660aa30500da2fb4359bb71fd4cb02427154a7945931d0f4d
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    NordVPN.json
                                                                    • Path C:\ProgramData\NordVPN\FeatureConfigs\NordVPN.json
                                                                    • Size 22KB
                                                                    • SHA256 72659e63abd13e0eaa6c1764ed3e0f9f44f5f09fc1758c3b9144f2e6321f8f42
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SharedConfig.json
                                                                    • Path C:\ProgramData\NordVPN\FeatureConfigs\SharedConfig.json
                                                                    • Size 6KB
                                                                    • SHA256 0ca913f65ebea19f6fabf471046a62ddef18675af3cc3067fe4f4f9b0d49b259
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ThreatProtection.json
                                                                    • Path C:\ProgramData\NordVPN\FeatureConfigs\ThreatProtection.json
                                                                    • Size 11KB
                                                                    • SHA256 7b266db83ca4dba921c529c02284f433d9c316dbcc18593b5d90abacd0d775e7
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    settings.db
                                                                    • Path C:\ProgramData\NordVPN\ThreatProtection\Settings\settings.db
                                                                    • Size 20KB
                                                                    • SHA256 cf8d640409cebb99e183bdb7322d041b50528f854effa0bc0786db54c2f99e50
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    settings.db-wal
                                                                    • Path C:\ProgramData\NordVPN\ThreatProtection\Settings\settings.db-wal
                                                                    • Size 32KB
                                                                    • SHA256 558886509707513f79aae676f8b0fb73c93e45a1ae27f081b1d6169ed91c8b30
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    settings.db-wal
                                                                    • Path C:\ProgramData\NordVPN\settings.db-wal
                                                                    • Size 32KB
                                                                    • SHA256 0072e3a3c30d9e3dad088ee61a2c3bed3aab5e5b219d3a193bf842eb960fbb6f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    1CD93E11.json
                                                                    • Path C:\ProgramData\NordVPN\settings\1CD93E11.json
                                                                    • Size 3KB
                                                                    • SHA256 4fb1d558a02f1412618cdf2741d9b0ea18499e537614174513dd69723506b3d8
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    1CD93E11.json.bak
                                                                    • Path C:\ProgramData\NordVPN\settings\1CD93E11.json.bak
                                                                    • Size 3KB
                                                                    • SHA256 c4081a24828c1b83c12676709c31eb149bd0ced39d6a916f4dc16156ea35a145
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    connection.db
                                                                    • Path C:\ProgramData\NordVPN\settings\connection.db
                                                                    • Size 20KB
                                                                    • SHA256 72e997c6709be5760d31405b7603606f19c64e88b68a97b85d4d4b5e8c4cf316
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    connection.db-wal
                                                                    • Path C:\ProgramData\NordVPN\settings\connection.db-wal
                                                                    • Size 40KB
                                                                    • SHA256 ab91a77e1d19289dc4f4208a6318c14a3c46064c57f7ee774575714e7bea9d05
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    vc_runtimeMinimum_x64.msi
                                                                    • Path C:\ProgramData\Package Cache\{43B0D101-A022-48F4-9D04-BA404CEB1D53}v14.44.35211\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
                                                                    • Size 208KB
                                                                    • SHA256 fe5af8f2efc9bbdd2c23f22f2d3daf480a4047acf3b1edc6ecda81147c1ec14f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                                                                    • Size 727B
                                                                    • SHA256 0dc7cea2d2c3558eb067d7981e1d74d295a37d301debeeb39ab7b05bba822d4a
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    357F04AD41BCF5FE18FCB69F60C6680F_6D77B5DFCBD6480F4BD6D0FA3C394104
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_6D77B5DFCBD6480F4BD6D0FA3C394104
                                                                    • Size 1KB
                                                                    • SHA256 7da5fd2f5588e0922911f39658b4dfd8ac2fd6ef256a571f0a77ff1bc9c5f65b
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    3B9DF3EA7CFCFDED92A8B4356F4D6C86_199B3EB75A5B6EBC4E82359B529314CB
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3B9DF3EA7CFCFDED92A8B4356F4D6C86_199B3EB75A5B6EBC4E82359B529314CB
                                                                    • Size 1KB
                                                                    • SHA256 d8772bfb9179d612e4a1fb9776f1ae0186c9a800d39adbacd4824f1022caf9eb
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    439F613B3D55693954E1B080DE3085B4_C14B486881EE76829D3D6096AF53D23B
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\439F613B3D55693954E1B080DE3085B4_C14B486881EE76829D3D6096AF53D23B
                                                                    • Size 1KB
                                                                    • SHA256 a5cbfd1ecf52cacf3f86afaf857cc75a5970c7c5cf1b601edd5093543d35b547
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    61A1C5C63BEAA1EA2A7E6CD3BE62EA26_892A9C841DD128677076CA4EDA2B76E2
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\61A1C5C63BEAA1EA2A7E6CD3BE62EA26_892A9C841DD128677076CA4EDA2B76E2
                                                                    • Size 1KB
                                                                    • SHA256 5ee387e849b836378d8ea39d11984568409b18c48c4033508cbcbf1a87e5e7da
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                    • Size 471B
                                                                    • SHA256 0ec57cb484835dcf94c576132b80efe8878b791a354024f7c56b6616068b9c12
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                                    • Size 1KB
                                                                    • SHA256 d74f0fdecc08c53e7c1b043e9ee9ebe66e4749f31886a40dcb380fe411ce8d24
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
                                                                    • Size 1KB
                                                                    • SHA256 d5f08640914ed20d6ac39b8bdeea45c11e4ad01beb2e062d35c77121e05e392b
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
                                                                    • Size 727B
                                                                    • SHA256 52bbb75060ceb11c3f4a420bfe0229edfef8ffd5017179204c8ce44ec94586fc
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E0EA2CD61F757CEB5BB65FC2C758BF4_59B8C30534EA03831AD62B87D9D5F56A
                                                                    • Size 400B
                                                                    • SHA256 eb749148cd16a835010858e4a7d959380770e744c1b7bd1e6d92638707e9e1af
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    357F04AD41BCF5FE18FCB69F60C6680F_6D77B5DFCBD6480F4BD6D0FA3C394104
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_6D77B5DFCBD6480F4BD6D0FA3C394104
                                                                    • Size 544B
                                                                    • SHA256 d2856b5da9261d0b67812ec75f0d66939966c093541e927f349d7db2ee5577dd
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    3B9DF3EA7CFCFDED92A8B4356F4D6C86_199B3EB75A5B6EBC4E82359B529314CB
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3B9DF3EA7CFCFDED92A8B4356F4D6C86_199B3EB75A5B6EBC4E82359B529314CB
                                                                    • Size 524B
                                                                    • SHA256 f30249e4a37bdf2e0e3a6c01306ab6fd744788c9b06e4bcdc34c83f880304d64
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    439F613B3D55693954E1B080DE3085B4_C14B486881EE76829D3D6096AF53D23B
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\439F613B3D55693954E1B080DE3085B4_C14B486881EE76829D3D6096AF53D23B
                                                                    • Size 510B
                                                                    • SHA256 494fb6bb3ee2b35a3490fb1fb234a463f54b3dd630afa4b0ec05d0b37ab6a93e
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    61A1C5C63BEAA1EA2A7E6CD3BE62EA26_892A9C841DD128677076CA4EDA2B76E2
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\61A1C5C63BEAA1EA2A7E6CD3BE62EA26_892A9C841DD128677076CA4EDA2B76E2
                                                                    • Size 554B
                                                                    • SHA256 68e0c14e81b74817d9b6fff530d02aad7e6ae257de469c323d0b84fb4e655c93
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                    • Size 400B
                                                                    • SHA256 87cbccf987c9c25e44eb5d295e40a50373b15d8bba0555ffbcc4f6ad7f294cf4
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
                                                                    • Size 536B
                                                                    • SHA256 5c4f08484399b9820162457aae7365e887078ba61def6f62728116760154ae24
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C
                                                                    • Size 508B
                                                                    • SHA256 2501d692e3099571d9ac7cfa9b845ce88895d3490cd1442d23ac3dfc9295a312
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
                                                                    • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_64A201640BD8E31E72E33FB1EBF9962D
                                                                    • Size 416B
                                                                    • SHA256 f829c20f70f829fb5d8fdf22c998c68bf850840e26babe045d23b7a4aeaf61f1
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    1717fb11-7016-4fd6-9d72-79f7402ac9c3.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1717fb11-7016-4fd6-9d72-79f7402ac9c3.tmp
                                                                    • Size 8KB
                                                                    • SHA256 687f2f5cc4eee7ca6902142f2caa96dc71253f18e9667fc93a29a806e85ad803
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    861d30f1-465c-4aac-a729-3f1595459b76.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\861d30f1-465c-4aac-a729-3f1595459b76.tmp
                                                                    • Size 105KB
                                                                    • SHA256 4ee1e0056f41a046e8efbfc68a394a9993e9e1572e402e58600b2c2d27cdbad0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 0f7109cda4c37ea8424815fbdafb9fdf6fd2dde3bfb80550af9aa9cd228e5614
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 4eebdc04ff118e9cd3cbb614d205d2b777bd24419c5ba2ae742de33b0ae98212
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    5341c7f6-e230-40a1-beee-7d36bdfbc782.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5341c7f6-e230-40a1-beee-7d36bdfbc782.tmp
                                                                    • Size 10KB
                                                                    • SHA256 b8a6226346fd2b8d02d803008f6e9483c30f2d98923d0b090967719cd1fe97d2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    8b9228cb-a0dc-4510-9b93-a9b55c2b1bc5.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8b9228cb-a0dc-4510-9b93-a9b55c2b1bc5.tmp
                                                                    • Size 10KB
                                                                    • SHA256 58fb14f78cfc587f314a0e3432928cb98f448e44b47bed9fd35015c2574898b4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    955e457f-c91a-4e6b-8c8a-22851f39a443.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\955e457f-c91a-4e6b-8c8a-22851f39a443.tmp
                                                                    • Size 33KB
                                                                    • SHA256 82d4ef011b97628da92655bf0f3adac2a2600993620f49fa5ead0b62f180e60a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    temp-index
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                    • Size 1KB
                                                                    • SHA256 2ede92dc2df8f6bd71dcba9be9acaf941c0ed166bf1020029dfd6943ae7f2ba5
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    the-real-index
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                    • Size 1KB
                                                                    • SHA256 d2b440fbc92f3a1c1681ef368a7f5494ab87542877fa0f609431f27d436b3c03
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    58bce54d-5c5d-4fc2-8a95-66a9ffea9b43.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\58bce54d-5c5d-4fc2-8a95-66a9ffea9b43.tmp
                                                                    • Size 2B
                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    dasherSettingSchema.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_2\dasherSettingSchema.json
                                                                    • Size 854B
                                                                    • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    016a977b-6565-481d-8e2f-9736390fd7e4.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\016a977b-6565-481d-8e2f-9736390fd7e4.tmp
                                                                    • Size 111B
                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    6d7351cb-e875-4d71-861e-0b02d2316f56.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6d7351cb-e875-4d71-861e-0b02d2316f56.tmp
                                                                    • Size 2B
                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    sync_diagnostic.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                    • Size 7KB
                                                                    • SHA256 eec256892623da693c3b7ab3e7d0745d033c42fd4ac7d8a26870edc37edb6b51
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ac08be47-a7c3-4f7a-89ea-f683daa29de3.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ac08be47-a7c3-4f7a-89ea-f683daa29de3.tmp
                                                                    • Size 11KB
                                                                    • SHA256 07371cbd8dab334abd505f98abdb914187f046f3138ce5de403459a07fc59af9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    b8755b76-ac0f-4bbc-abea-cbad1546dd07.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b8755b76-ac0f-4bbc-abea-cbad1546dd07.tmp
                                                                    • Size 70KB
                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    cc829048-8462-449a-b9e3-b0e560d3d1ae.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cc829048-8462-449a-b9e3-b0e560d3d1ae.tmp
                                                                    • Size 6B
                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    e8615336-6ce9-4267-b2e0-13e6221308ad.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e8615336-6ce9-4267-b2e0-13e6221308ad.tmp
                                                                    • Size 8KB
                                                                    • SHA256 586cd557f17ac4c0777c5c096e72c5ead2e337dee47d99592974449c81dcf077
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    4cb71a88-d0e6-48a8-b640-f5dc8c6923a4.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4cb71a88-d0e6-48a8-b640-f5dc8c6923a4.tmp
                                                                    • Size 13B
                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    f1dd2a83-9a81-4918-9b83-0c7992b87c28.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f1dd2a83-9a81-4918-9b83-0c7992b87c28.tmp
                                                                    • Size 18KB
                                                                    • SHA256 cb5ffa2cf01dcf201f3c80a9f3799d4709cbc99aa3d691a24ee1688d2aa37ea8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    f4d7003b-9c8f-410d-989e-b03ebbac068e.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f4d7003b-9c8f-410d-989e-b03ebbac068e.tmp
                                                                    • Size 18KB
                                                                    • SHA256 358eab23800410ed4a748085f79d84d7fca2ede0d38d28791c7f0d6f3e8e125a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    UserJourney.json
                                                                    • Path C:\Users\Admin\AppData\Local\NordVPN\FeatureConfigs\UserJourney.json
                                                                    • Size 1KB
                                                                    • SHA256 7e331e30165fb959de2d50e8b7842c29740c12cd23b1b2ee8f38ff98642d5f08
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    servers_v2.json
                                                                    • Path C:\Users\Admin\AppData\Local\NordVPN\servers_v2.json
                                                                    • Size 6.0MB
                                                                    • SHA256 76f4e60803a2fa51df7f2eeeba9545fd09da2f26d542fe1e8f18d6679817dbdd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    settings.db-wal
                                                                    • Path C:\Users\Admin\AppData\Local\NordVPN\settings.db-wal
                                                                    • Size 32KB
                                                                    • SHA256 4e866e084835b843244a970f1232f3d37e1e5a184c1b5f0a16c025ab9907631b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    88f1bf83-f3bb-4d7b-b9f4-d258a1bd7545.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\88f1bf83-f3bb-4d7b-b9f4-d258a1bd7545.tmp
                                                                    • Size 1B
                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    bacd4548-0533-4c91-99ce-a032296d8243.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\bacd4548-0533-4c91-99ce-a032296d8243.tmp
                                                                    • Size 157KB
                                                                    • SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    CommandLine.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\CommandLine.dll
                                                                    • Size 231KB
                                                                    • SHA256 e2255b67144ebe4e23a6d78611fc7ecedddcd39682d8fc3d42453d8b446d1167
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    CommunityToolkit.Mvvm.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\CommunityToolkit.Mvvm.dll
                                                                    • Size 114KB
                                                                    • SHA256 a2ab2e94556733b0bb8a56c7f79e8ea0a363f984c49a0ae757e329a273a45774
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Macross.Json.Extensions.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\Macross.Json.Extensions.dll
                                                                    • Size 53KB
                                                                    • SHA256 6e5c2df6d5d672a1244b20bf072db319ab324d20939f03acf2436db307713c31
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    MediatR.Contracts.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\MediatR.Contracts.dll
                                                                    • Size 18KB
                                                                    • SHA256 f92654888311d7f76f32a6cad7cd1063b67dfbe61d3fbc2b55d8a67d374702a5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    MediatR.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\MediatR.dll
                                                                    • Size 82KB
                                                                    • SHA256 59f5e2db10f92933c6677f9fbf6f5a19c0fa37501f690cceb884c25b4724d134
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.DependencyInjection.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\Microsoft.Extensions.DependencyInjection.dll
                                                                    • Size 90KB
                                                                    • SHA256 158761ce778e799949f3a3060c461b1055bb35f1f5a65eff0e42397849f09ecd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Logging.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\Microsoft.Extensions.Logging.dll
                                                                    • Size 49KB
                                                                    • SHA256 b2cfba2e05ee89a91e9bc9cf112468a5f4fa05d1a77ea81c131ea656f3d133c2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Microsoft.Extensions.Options.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\Microsoft.Extensions.Options.dll
                                                                    • Size 63KB
                                                                    • SHA256 5e01894cbc0661bacb8ca8f485a40d5ee4e02f28fef58007668a0276431b4693
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    MooseTrackerLight.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\MooseTrackerLight.dll
                                                                    • Size 42KB
                                                                    • SHA256 c0f7e39fc1ddbc3dd2f518be4b7a4c6417a7d4d8921c693a63577fac8a9f9819
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordInstaller.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordInstaller.dll
                                                                    • Size 271KB
                                                                    • SHA256 6824cfd3360744eddc756a24abe382385ef97af8b191654d0787211c6f1669e3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.FeatureConfig.Abstractions.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordSecurity.FeatureConfig.Abstractions.dll
                                                                    • Size 21KB
                                                                    • SHA256 342b506f0db5b97571d9e5dd6e96f80e1b9aba4218f0cc05087cd5ae05c69311
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.FeatureConfig.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordSecurity.FeatureConfig.dll
                                                                    • Size 78KB
                                                                    • SHA256 8f98b076d3e4122026520e277ec722f1d224a874a98cee9ec7f8ebfb61ea57c4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.LibMoose.Core.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordSecurity.LibMoose.Core.dll
                                                                    • Size 32KB
                                                                    • SHA256 10c09df9fed46be2c9945aa8736282f9673a9dbfeb31165bee73f4d9abf3b3d8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.LibNudler.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordSecurity.LibNudler.dll
                                                                    • Size 41KB
                                                                    • SHA256 304373c98e676657b1c9ec6c887ee9856647d678899250e7aea8613a425abca1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.Liberation.Configuration.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordSecurity.Liberation.Configuration.dll
                                                                    • Size 17KB
                                                                    • SHA256 52a6bff59d65f2de90020ec2c9ca6ead87caa11355ce39db8159ba2c8cf63cb5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.NordInstaller.Execution.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordSecurity.NordInstaller.Execution.dll
                                                                    • Size 31KB
                                                                    • SHA256 100fe4566da6ad8cc6155095dcf0cd868569a9e7a26f4fe8d6c522d3401dc694
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.NordInstaller.Shared.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordSecurity.NordInstaller.Shared.dll
                                                                    • Size 198KB
                                                                    • SHA256 94264434d28e13f41fcb1830cced549609266515f963800db910a20dc6409217
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.NordInstaller.WizardSteps.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordSecurity.NordInstaller.WizardSteps.dll
                                                                    • Size 524KB
                                                                    • SHA256 d70a63bdd4c36d0d2e052472f6315915a4cd20905095209350a606b5dac4f6a1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.UI.Controls.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordSecurity.UI.Controls.dll
                                                                    • Size 1.9MB
                                                                    • SHA256 3fa230c0d56a6eef9905b89fe8638f4033747fa04ec99003a6c52bb11fa98cb9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordSecurity.Validation.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\NordSecurity.Validation.dll
                                                                    • Size 27KB
                                                                    • SHA256 a2ea211643e7589af5f35778b035f7a04ad57a2e32b4b8c4a104108b410b8f7f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Serilog.Expressions.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\Serilog.Expressions.dll
                                                                    • Size 207KB
                                                                    • SHA256 5b791718d445f60e1ed97fa33db24f0529e22da9e9a542d9e1baa2912f993edc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Serilog.Extensions.Logging.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\Serilog.Extensions.Logging.dll
                                                                    • Size 40KB
                                                                    • SHA256 e7ce190a990fd23935ed36e3a8bc1255d5da6f7186e03d69dd763417e56e697e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Serilog.Sinks.File.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\Serilog.Sinks.File.dll
                                                                    • Size 41KB
                                                                    • SHA256 f2c0939abeb8c8276a4a70ab47158b9ff81b560430c3d6f2d9becffe0c298147
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Serilog.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\Serilog.dll
                                                                    • Size 161KB
                                                                    • SHA256 dae8c1f3c0897afd187e5577795874614481d51a30ebae3ef3ca91ef4f96ae0d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SharpVectors.Runtime.Wpf.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\SharpVectors.Runtime.Wpf.dll
                                                                    • Size 83KB
                                                                    • SHA256 a17b7c2b2874837c4c11f85cbff58f9a0096010919726ee543a70313c300ecc5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    System.Management.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\1.10.1.0\System.Management.dll
                                                                    • Size 287KB
                                                                    • SHA256 6995bc11aa735e6772222e782eea80238663d11fbe577435310735ce0a197335
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordInstaller.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\fe4f3d64-6abc-423a-8390-f3bf52894636\NordInstaller.exe
                                                                    • Size 582KB
                                                                    • SHA256 d057a226a6bfcedacb46980595ee1d63c98fdce7f9a15b128510bba492d08cc6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Nord.Setup.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-FKQJS.tmp\Nord.Setup.dll
                                                                    • Size 35KB
                                                                    • SHA256 20784bf60fb3f44a0fa89b14786654d5a835d983c65860e24e966400dea6cc7e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    deldirrpa.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-FKQJS.tmp\deldirrpa.exe
                                                                    • Size 320KB
                                                                    • SHA256 38c622d489054711ef253fc1f6a9545fce82298effd7936355b8b682b6689e5a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    isxdl.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-FKQJS.tmp\isxdl.dll
                                                                    • Size 170KB
                                                                    • SHA256 98d547efb2bb65c32cc278beed99c4c9ce83e63f0032ad327fbc5241cdbaab90
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    vea4gv1k.g2r..tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-GDIKM.tmp\vea4gv1k.g2r..tmp
                                                                    • Size 3.2MB
                                                                    • SHA256 dd6f3a13cf8b0a36564ff343c7b63d562cf71ab416a30b01f466eea8cf410740
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Nord.Setup.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\Nord.Setup.dll
                                                                    • Size 36KB
                                                                    • SHA256 5267b8acc53a844385574724cffb1ccfd4b5b705017b6afe2f1d28767aab1ffb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordUpdaterSetup.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\NordUpdaterSetup.exe
                                                                    • Size 4.3MB
                                                                    • SHA256 99210b0b29827e9824d052c9945d61701850514c2220ff1631eb8b7920987580
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    _setup64.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\_isetup\_setup64.tmp
                                                                    • Size 6KB
                                                                    • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    deldirrpa.exe
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\deldirrpa.exe
                                                                    • Size 318KB
                                                                    • SHA256 a3fe1bd1ae899062f7f16d7f4e247ad2269b07ce3ace4a2ce84793512ae2074d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    isxdl.dll
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-Q97CN.tmp\isxdl.dll
                                                                    • Size 169KB
                                                                    • SHA256 48003909f632c53e9ab7edaf8660b6a12070325d733c7c14f0e3c2d72487a8fc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NordUpdaterSetup.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-V35AB.tmp\NordUpdaterSetup.tmp
                                                                    • Size 3.3MB
                                                                    • SHA256 00f9f22e5f7ad3cc67e16b705ff7496687d059e4a1815535db33bc4676614ca9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    messages.json
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6076_1243844561\CRX_INSTALL\_locales\en_CA\messages.json
                                                                    • Size 711B
                                                                    • SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    content.js
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6076_412210659\CRX_INSTALL\content.js
                                                                    • Size 9KB
                                                                    • SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    df2fabc4-2483-4b7b-98ce-9a876ae343c0.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6076_412210659\df2fabc4-2483-4b7b-98ce-9a876ae343c0.tmp
                                                                    • Size 10KB
                                                                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Icon.png
                                                                    • Path C:\Users\Admin\AppData\Local\ToastNotificationManagerCompat\Apps\NordVPN\Icon.png
                                                                    • Size 2KB
                                                                    • SHA256 2b618faad400597cd6b8b415333298213bf349f53066a6e50f823eb23a89cd0f
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    wireguard.cat
                                                                    • Path C:\Windows\System32\DriverStore\Temp\{0a8d560c-05ff-af44-9f0b-5a79c56e0332}\wireguard.cat
                                                                    • Size 9KB
                                                                    • SHA256 6beb0344558df571234365d925c9d1ff0661b4806d87a3a7ed10f86cbe1e16a4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    wireguard.sys
                                                                    • Path C:\Windows\System32\DriverStore\Temp\{0a8d560c-05ff-af44-9f0b-5a79c56e0332}\wireguard.sys
                                                                    • Size 477KB
                                                                    • SHA256 94def0c6290dbc32ebb9a6e72d2f76d0ffe66365606efeef952834768e47f1d8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    desktop.ini
                                                                    • Path C:\Windows\System32\config\systemprofile\Documents\desktop.ini
                                                                    • Size 418B
                                                                    • SHA256 954b525be189a7fee40084bce8a1d9380280d109d64695e0c09b940c708aa274
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    __PSScriptPolicyTest_fv1f0gin.t4y.ps1
                                                                    • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_fv1f0gin.t4y.ps1
                                                                    • Size 69B
                                                                    • SHA256 ddf086f72b2ab23b32e73bc2ee3543d85fc453f4e2808d32914b925e78f616f2
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    wireguard.inf
                                                                    • Path C:\Windows\Temp\a9dd59a1a5736d0351697b3b90858cfd54cee858ca2cc057644b67c3bcdaf7e8\wireguard.inf
                                                                    • Size 2KB
                                                                    • SHA256 079e58e9b00de894557bae8feb40cc578070376a52971bd733d74e8955b3b126
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    logo.png
                                                                    • Path C:\Windows\Temp\{14F910E0-E477-4DE1-B631-F685A7BA245F}\.ba\logo.png
                                                                    • Size 1KB
                                                                    • SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    VC_redist.x64.exe
                                                                    • Path C:\Windows\Temp\{14F910E0-E477-4DE1-B631-F685A7BA245F}\.be\VC_redist.x64.exe
                                                                    • Size 670KB
                                                                    • SHA256 568c9ba533624084ea18f7a562b4aa2249ed4e41281524a061a0d0b1008cf6bd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    BootstrapperApplicationData.xml
                                                                    • Path C:\Windows\Temp\{6833E754-66E1-4846-A46B-22BE42471EB0}\.ba\BootstrapperApplicationData.xml
                                                                    • Size 14KB
                                                                    • SHA256 8c81100f594e3d0bc51e5571e0046f016086207c1c382d45708c30e1d732b648
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    wixstdba.dll
                                                                    • Path C:\Windows\Temp\{6833E754-66E1-4846-A46B-22BE42471EB0}\.ba\wixstdba.dll
                                                                    • Size 215KB
                                                                    • SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    license.rtf
                                                                    • Path C:\Windows\Temp\{9455A3A7-9A3B-497F-A94A-B41C7A863373}\.ba\license.rtf
                                                                    • Size 9KB
                                                                    • SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    thm.wxl
                                                                    • Path C:\Windows\Temp\{9455A3A7-9A3B-497F-A94A-B41C7A863373}\.ba\thm.wxl
                                                                    • Size 2KB
                                                                    • SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    thm.xml
                                                                    • Path C:\Windows\Temp\{9455A3A7-9A3B-497F-A94A-B41C7A863373}\.ba\thm.xml
                                                                    • Size 8KB
                                                                    • SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    memory/388-566-0x00000000009B0000-0x0000000000AA0000-memory.dmp
                                                                    Download

                                                                    memory/388-286-0x00000000009B0000-0x0000000000AA0000-memory.dmp
                                                                    Download

                                                                    memory/652-4359-0x00007FFEA04D0000-0x00007FFEA3A96000-memory.dmp
                                                                    Download

                                                                    memory/652-4368-0x00007FFEA04D0000-0x00007FFEA3A96000-memory.dmp
                                                                    Download

                                                                    memory/652-4298-0x00007FFEA04D0000-0x00007FFEA3A96000-memory.dmp
                                                                    Download

                                                                    memory/652-4412-0x00007FFEA04D0000-0x00007FFEA3A96000-memory.dmp
                                                                    Download

                                                                    memory/652-4343-0x00007FFEA04D0000-0x00007FFEA3A96000-memory.dmp
                                                                    Download

                                                                    memory/652-4413-0x00007FFEA04D0000-0x00007FFEA3A96000-memory.dmp
                                                                    Download

                                                                    memory/652-3811-0x00007FFEA04D0000-0x00007FFEA3A96000-memory.dmp
                                                                    Download

                                                                    memory/1084-813-0x0000000000840000-0x00000000008B7000-memory.dmp
                                                                    Download

                                                                    memory/2000-816-0x0000000000840000-0x00000000008B7000-memory.dmp
                                                                    Download

                                                                    memory/2312-281-0x0000000000DE0000-0x0000000000EC8000-memory.dmp
                                                                    Download

                                                                    memory/2312-3141-0x0000000000DE0000-0x0000000000EC8000-memory.dmp
                                                                    Download

                                                                    memory/2312-240-0x0000000000DE0000-0x0000000000EC8000-memory.dmp
                                                                    Download

                                                                    memory/3212-1808-0x0000000000240000-0x0000000000587000-memory.dmp
                                                                    Download

                                                                    memory/3212-3140-0x0000000000240000-0x0000000000587000-memory.dmp
                                                                    Download

                                                                    memory/3212-3078-0x0000000000240000-0x0000000000587000-memory.dmp
                                                                    Download

                                                                    memory/3212-266-0x0000000003BD0000-0x0000000003BDE000-memory.dmp
                                                                    Download

                                                                    memory/3212-267-0x0000000073240000-0x000000007324E000-memory.dmp
                                                                    Download

                                                                    memory/3212-624-0x0000000000240000-0x0000000000587000-memory.dmp
                                                                    Download

                                                                    memory/3212-282-0x0000000000240000-0x0000000000587000-memory.dmp
                                                                    Download

                                                                    memory/3780-815-0x0000000000840000-0x00000000008B7000-memory.dmp
                                                                    Download

                                                                    memory/5548-556-0x0000020DFF220000-0x0000020DFF228000-memory.dmp
                                                                    Download

                                                                    memory/5548-505-0x0000020DFF0B0000-0x0000020DFF0CE000-memory.dmp
                                                                    Download

                                                                    memory/5548-3784-0x0000020E002C0000-0x0000020E00374000-memory.dmp
                                                                    Download

                                                                    memory/5548-3785-0x0000020DFFEC0000-0x0000020DFFEE2000-memory.dmp
                                                                    Download

                                                                    memory/5548-517-0x0000020DFF190000-0x0000020DFF1AC000-memory.dmp
                                                                    Download

                                                                    memory/5548-520-0x0000020DFF160000-0x0000020DFF16A000-memory.dmp
                                                                    Download

                                                                    memory/5548-523-0x0000020DFF1E0000-0x0000020DFF1F8000-memory.dmp
                                                                    Download

                                                                    memory/5548-537-0x0000020DFF260000-0x0000020DFF278000-memory.dmp
                                                                    Download

                                                                    memory/5548-538-0x0000020DFF210000-0x0000020DFF21C000-memory.dmp
                                                                    Download

                                                                    memory/5548-539-0x0000020DFF560000-0x0000020DFF576000-memory.dmp
                                                                    Download

                                                                    memory/5548-543-0x0000020DFF580000-0x0000020DFF594000-memory.dmp
                                                                    Download

                                                                    memory/5548-544-0x0000020DFF720000-0x0000020DFF73E000-memory.dmp
                                                                    Download

                                                                    memory/5548-552-0x0000020DFF820000-0x0000020DFF83A000-memory.dmp
                                                                    Download

                                                                    memory/5548-553-0x0000020DFFEF0000-0x0000020DFFF6A000-memory.dmp
                                                                    Download

                                                                    memory/5548-513-0x0000020DFF410000-0x0000020DFF4FA000-memory.dmp
                                                                    Download

                                                                    memory/5548-554-0x0000020DFF840000-0x0000020DFF866000-memory.dmp
                                                                    Download

                                                                    memory/5548-521-0x0000020DFF1B0000-0x0000020DFF1C0000-memory.dmp
                                                                    Download

                                                                    memory/5548-511-0x0000020DFF170000-0x0000020DFF18A000-memory.dmp
                                                                    Download

                                                                    memory/5548-512-0x0000020DFF0F0000-0x0000020DFF0FA000-memory.dmp
                                                                    Download

                                                                    memory/5548-510-0x0000020DFEAA0000-0x0000020DFEAA8000-memory.dmp
                                                                    Download

                                                                    memory/5548-508-0x0000020DFF0D0000-0x0000020DFF0E4000-memory.dmp
                                                                    Download

                                                                    memory/5548-3757-0x0000020E00050000-0x0000020E000A0000-memory.dmp
                                                                    Download

                                                                    memory/5548-503-0x0000020DFF110000-0x0000020DFF14E000-memory.dmp
                                                                    Download

                                                                    memory/5548-495-0x0000020DFE4F0000-0x0000020DFE4FE000-memory.dmp
                                                                    Download

                                                                    memory/5548-493-0x0000020DFE4B0000-0x0000020DFE4BE000-memory.dmp
                                                                    Download

                                                                    memory/5548-519-0x0000020DFF150000-0x0000020DFF15A000-memory.dmp
                                                                    Download

                                                                    memory/5548-3734-0x0000020DFFEA0000-0x0000020DFFEB2000-memory.dmp
                                                                    Download

                                                                    memory/5548-3744-0x0000020DFF200000-0x0000020DFF208000-memory.dmp
                                                                    Download

                                                                    memory/5548-3756-0x0000020DFF280000-0x0000020DFF288000-memory.dmp
                                                                    Download

                                                                    memory/5548-3742-0x0000020DFFFB0000-0x0000020DFFFEC000-memory.dmp
                                                                    Download

                                                                    memory/5620-4387-0x000001ECA0DF0000-0x000001ECA0DF1000-memory.dmp
                                                                    Download

                                                                    memory/5620-4378-0x000001ECA0DF0000-0x000001ECA0DF1000-memory.dmp
                                                                    Download

                                                                    memory/5620-4389-0x000001ECA0DF0000-0x000001ECA0DF1000-memory.dmp
                                                                    Download

                                                                    memory/5620-4385-0x000001ECA0DF0000-0x000001ECA0DF1000-memory.dmp
                                                                    Download

                                                                    memory/5620-4383-0x000001ECA0DF0000-0x000001ECA0DF1000-memory.dmp
                                                                    Download

                                                                    memory/5620-4388-0x000001ECA0DF0000-0x000001ECA0DF1000-memory.dmp
                                                                    Download

                                                                    memory/5620-4379-0x000001ECA0DF0000-0x000001ECA0DF1000-memory.dmp
                                                                    Download

                                                                    memory/5620-4386-0x000001ECA0DF0000-0x000001ECA0DF1000-memory.dmp
                                                                    Download

                                                                    memory/5620-4384-0x000001ECA0DF0000-0x000001ECA0DF1000-memory.dmp
                                                                    Download

                                                                    memory/5620-4377-0x000001ECA0DF0000-0x000001ECA0DF1000-memory.dmp
                                                                    Download

                                                                    memory/5968-311-0x0000000003700000-0x000000000370E000-memory.dmp
                                                                    Download

                                                                    memory/5968-312-0x000000006E690000-0x000000006E69E000-memory.dmp
                                                                    Download

                                                                    memory/5968-565-0x0000000000FF0000-0x000000000133F000-memory.dmp
                                                                    Download