c51c5f40cef61eac6f7f089eaaf7ed01e7eb7b1d4784e4afdf2a49370a8e20b9

Analysis

max time kernel
210s
max time network
211s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-09-2022 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UrbanVPN2.exe
Size

30.3MB
MD5

15cdd9b014e75e1ead180d615df07bf5
SHA1

f0d8f4909730277956e01ada357e1ad12d7e14e8
SHA256

c51c5f40cef61eac6f7f089eaaf7ed01e7eb7b1d4784e4afdf2a49370a8e20b9
SHA512

6d509c260f45aa5742a06fed9a7ea996a43bc38c48b709f6d7ca2ac2fab5be30b3b508b8e6d7a557d3687e693c09818a7f864c08724c76c244c2af710e6e0123
SSDEEP

786432:RtlRwYHHrrh2Y28c6k2OpHf71ovVIcbnkGR3Qf:R7vIHfhJgkGRW

Score

8^/10

discovery evasion persistence trojan

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	1096	msiexec.exe
7	1104	MsiExec.exe
8	1104	MsiExec.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SETE8DA.tmp	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SETE8DA.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\tap0901.sys	DrvInst.exe

Executes dropped EXE 5 IoCs

pid	Process
1760	MSIC881.tmp
1492	tapinstall.exe
1296	tapinstall.exe
2268	MSIF11B.tmp
2568	UrbanVPNUpdater.exe

Loads dropped DLL 46 IoCs

pid	Process
860	UrbanVPN2.exe
860	UrbanVPN2.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe
664	MsiExec.exe
664	MsiExec.exe
1104	MsiExec.exe
664	MsiExec.exe
664	MsiExec.exe
1104	MsiExec.exe
1104	MsiExec.exe
1104	MsiExec.exe
664	MsiExec.exe
664	MsiExec.exe
860	UrbanVPN2.exe
664	MsiExec.exe
664	MsiExec.exe
664	MsiExec.exe
664	MsiExec.exe
664	MsiExec.exe
664	MsiExec.exe
1760	MSIC881.tmp
1760	MSIC881.tmp
1760	MSIC881.tmp
1760	MSIC881.tmp
1760	MSIC881.tmp
1760	MSIC881.tmp
1760	MSIC881.tmp
664	MsiExec.exe
1104	MsiExec.exe
1104	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
2512	MsiExec.exe
664	MsiExec.exe
2512	MsiExec.exe
664	MsiExec.exe
1984	MsiExec.exe
1984	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UrbanVPN = "C:\\Program Files\\UrbanVPN\\UrbanVPNUpdater.exe /checknow -minuseractions -startappfirst -restartapp \"C:\\Program Files\\UrbanVPN\\bin\\urbanvpn-gui.exe\" "	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MSIF11B.tmp

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	UrbanVPN2.exe
File opened (read-only)	\??\Z:	UrbanVPN2.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	UrbanVPN2.exe
File opened (read-only)	\??\I:	UrbanVPN2.exe
File opened (read-only)	\??\E:	UrbanVPN2.exe
File opened (read-only)	\??\O:	UrbanVPN2.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	UrbanVPN2.exe
File opened (read-only)	\??\Q:	UrbanVPN2.exe
File opened (read-only)	\??\A:	UrbanVPN2.exe
File opened (read-only)	\??\M:	UrbanVPN2.exe
File opened (read-only)	\??\N:	UrbanVPN2.exe
File opened (read-only)	\??\T:	UrbanVPN2.exe
File opened (read-only)	\??\Y:	UrbanVPN2.exe
File opened (read-only)	\??\J:	UrbanVPN2.exe
File opened (read-only)	\??\B:	UrbanVPN2.exe
File opened (read-only)	\??\Q:	UrbanVPN2.exe
File opened (read-only)	\??\T:	UrbanVPN2.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	UrbanVPN2.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	UrbanVPN2.exe
File opened (read-only)	\??\W:	UrbanVPN2.exe
File opened (read-only)	\??\Z:	UrbanVPN2.exe
File opened (read-only)	\??\H:	UrbanVPN2.exe
File opened (read-only)	\??\Y:	UrbanVPN2.exe
File opened (read-only)	\??\A:	UrbanVPN2.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	UrbanVPN2.exe
File opened (read-only)	\??\M:	UrbanVPN2.exe
File opened (read-only)	\??\P:	UrbanVPN2.exe
File opened (read-only)	\??\K:	UrbanVPN2.exe
File opened (read-only)	\??\L:	UrbanVPN2.exe
File opened (read-only)	\??\X:	UrbanVPN2.exe
File opened (read-only)	\??\F:	UrbanVPN2.exe
File opened (read-only)	\??\P:	UrbanVPN2.exe
File opened (read-only)	\??\L:	UrbanVPN2.exe
File opened (read-only)	\??\N:	UrbanVPN2.exe
File opened (read-only)	\??\S:	UrbanVPN2.exe
File opened (read-only)	\??\U:	UrbanVPN2.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	UrbanVPN2.exe
File opened (read-only)	\??\R:	UrbanVPN2.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	UrbanVPN2.exe
File opened (read-only)	\??\V:	UrbanVPN2.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	UrbanVPN2.exe
File opened (read-only)	\??\W:	UrbanVPN2.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	UrbanVPN2.exe
File opened (read-only)	\??\R:	UrbanVPN2.exe
File opened (read-only)	\??\A:	msiexec.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\SETD135.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\oemvista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_neutral_6d4bec28a2ef0cdf\oemvista.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	tapinstall.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\SETD135.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\SETD136.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\SETD137.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	tapinstall.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\SETD136.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\SETD137.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_neutral_6d4bec28a2ef0cdf\oemvista.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	tapinstall.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\UrbanVPN\bin\urbanvpn-gui.exe	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\liblzo2-2.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\libssl-1_1-x64.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\UrbanVPNUpdater.exe	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\urbanvpn.dll	msiexec.exe
File created	C:\Program Files\TAP-Windows\icon.ico	MSIC881.tmp
File created	C:\Program Files\UrbanVPN\bin\urbanvpn.exe	msiexec.exe
File created	C:\Program Files\TAP-Windows\Uninstall.exe	MSIC881.tmp
File created	C:\Program Files\UrbanVPN\bin\urbanvpnserv.exe	msiexec.exe
File opened for modification	C:\Program Files\UrbanVPN\UrbanVPNUpdater.ini	msiexec.exe
File created	C:\Program Files\TAP-Windows\bin\tapinstall.exe	MSIC881.tmp
File created	C:\Program Files\TAP-Windows\bin\deltapall.bat	MSIC881.tmp
File created	C:\Program Files\TAP-Windows\license.txt	MSIC881.tmp
File created	C:\Program Files\UrbanVPN\bin\openssl.exe	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\libcrypto-1_1-x64.dll	msiexec.exe
File created	C:\Program Files\TAP-Windows\driver\OemVista.inf	MSIC881.tmp
File created	C:\Program Files\TAP-Windows\driver\tap0901.cat	MSIC881.tmp
File created	C:\Program Files\UrbanVPN\bin\libpkcs11-helper-1.dll	msiexec.exe
File created	C:\Program Files\TAP-Windows\driver\tap0901.sys	MSIC881.tmp
File created	C:\Program Files\TAP-Windows\bin\addtap.bat	MSIC881.tmp

Drops file in Windows directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIC521.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI8F13.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9184.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6ca2d6.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA19.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB40C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC63B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6E9.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIA595.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB236.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC776.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI139C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9194.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB796.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI1012.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{47612473-AB88-4021-B630-14E71B71F20E}\urbanvpngui_1.exe	msiexec.exe
File created	C:\Windows\Installer\{47612473-AB88-4021-B630-14E71B71F20E}\urbanvpngui_1.exe	msiexec.exe
File created	C:\Windows\Installer\6ca2d5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\6ca2d5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB2B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC494.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	tapinstall.exe
File opened for modification	C:\Windows\Installer\MSIEFD0.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB207.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB5F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF08E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI91C4.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIB7D6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC881.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEFE1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF11B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSIAAB6.tmp	msiexec.exe
File created	C:\Windows\Installer\6ca2d6.ipi	msiexec.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File created	C:\Windows\INF\oem2.PNF	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 5 IoCs

installer

resource	yara_rule
behavioral1/files/0x000600000001422f-93.dat	nsis_installer_2
behavioral1/files/0x000a000000016d33-139.dat	nsis_installer_1
behavioral1/files/0x000a000000016d33-139.dat	nsis_installer_2
behavioral1/files/0x000a000000016d33-141.dat	nsis_installer_1
behavioral1/files/0x000a000000016d33-141.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	perfmon.exe

Modifies Internet Explorer settings 1 TTPs 50 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	UrbanVPN2.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\urban-vpn.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.urban-vpn.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.urban-vpn.com\ = "39"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.urban-vpn.com\ = "79"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02c7a96c8c5d801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "39"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\urban-vpn.com\Total = "39"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "79"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.urban-vpn.com\ = "118"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\urban-vpn.com\Total = "118"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA56AF91-31BB-11ED-991C-C6F54D7498C3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\urban-vpn.com\Total = "79"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "158"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.urban-vpn.com\ = "158"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000d659843560ed3d1f18ed4747d4acc8f6123eb37f591676e90384a74c2d3a1bb5000000000e80000000020000200000005ab2ae061a0d7d9459a6a4a0c15c7c1df2e445683fe9588a38c50c8fba61b8472000000010bf94b5e061e8c74cd6a7351b286335698b448c3b0e8cc179f063c4e44c939740000000890b4225a6bd9ecdfc399082c7129ed37371c47d91dfa07402cf89710939cadbb6d4dabcf6ee15bdf2ce16d16c8431b0c63561d2bed613321bef49d9ab22f12c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\urban-vpn.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "118"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DOMStorage\urban-vpn.com\Total = "158"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000ac3c4c946ee148bcf49c03725535c31803b5fe50258860f8d3536cdce199d9f6000000000e80000000020000200000000baf74bbd9909d46725a8e03e2aded7034ac8c5d0962f57db0f91251a49bc4639000000027264a408ceab84127c718dcbec31400e50ee624ebd06847ab06d51b42a9addfeed42d30ea38facd9af1c65bd2a4aac64011bc9407f7852bbaf6c356a835d32338273f4534e2f4141d6f0d52c2ca339e20a90d62e3703a82a69be0ac3b2602478753a8979cf7dd23839b986c357468a2a48c2c4e1c4d2770f0b6dd0ffa3a24cd4bb95ba7143dd63f6f8f54241628d7854000000034c479bd9d04bc5e62f5aee0096aa76682504396f410118265e8cb63442e7d1687690507e65d594657e11ce78c8c856ef0107fd049f60f17b5fad53b6d76a695	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tcpipcfg.dll,-50002 = "TCP/IP version 6. The latest version of the internet protocol that provides communication across diverse interconnected networks."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tcpipcfg.dll,-50001 = "Transmission Control Protocol/Internet Protocol. The default wide area network protocol that provides communication across diverse interconnected networks."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\System32\drivers\pacer.sys,-100 = "Quality of Service Packet Scheduler. This component provides network traffic control, including rate-of-flow and prioritization services."	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	tapinstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	tapinstall.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\www23F3.tmp\:favicon:$DATA	IEXPLORE.EXE
File created	C:\Users\Admin\AppData\Local\Temp\URLF133.url\:favicon:$DATA	IEXPLORE.EXE
File created	C:\Users\Admin\AppData\Local\Temp\URLF133.url:favicon	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1984	MsiExec.exe
1984	MsiExec.exe
1096	msiexec.exe
1096	msiexec.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe
1184	perfmon.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1096	msiexec.exe
Token: SeTakeOwnershipPrivilege	1096	msiexec.exe
Token: SeSecurityPrivilege	1096	msiexec.exe
Token: SeCreateTokenPrivilege	860	UrbanVPN2.exe
Token: SeAssignPrimaryTokenPrivilege	860	UrbanVPN2.exe
Token: SeLockMemoryPrivilege	860	UrbanVPN2.exe
Token: SeIncreaseQuotaPrivilege	860	UrbanVPN2.exe
Token: SeMachineAccountPrivilege	860	UrbanVPN2.exe
Token: SeTcbPrivilege	860	UrbanVPN2.exe
Token: SeSecurityPrivilege	860	UrbanVPN2.exe
Token: SeTakeOwnershipPrivilege	860	UrbanVPN2.exe
Token: SeLoadDriverPrivilege	860	UrbanVPN2.exe
Token: SeSystemProfilePrivilege	860	UrbanVPN2.exe
Token: SeSystemtimePrivilege	860	UrbanVPN2.exe
Token: SeProfSingleProcessPrivilege	860	UrbanVPN2.exe
Token: SeIncBasePriorityPrivilege	860	UrbanVPN2.exe
Token: SeCreatePagefilePrivilege	860	UrbanVPN2.exe
Token: SeCreatePermanentPrivilege	860	UrbanVPN2.exe
Token: SeBackupPrivilege	860	UrbanVPN2.exe
Token: SeRestorePrivilege	860	UrbanVPN2.exe
Token: SeShutdownPrivilege	860	UrbanVPN2.exe
Token: SeDebugPrivilege	860	UrbanVPN2.exe
Token: SeAuditPrivilege	860	UrbanVPN2.exe
Token: SeSystemEnvironmentPrivilege	860	UrbanVPN2.exe
Token: SeChangeNotifyPrivilege	860	UrbanVPN2.exe
Token: SeRemoteShutdownPrivilege	860	UrbanVPN2.exe
Token: SeUndockPrivilege	860	UrbanVPN2.exe
Token: SeSyncAgentPrivilege	860	UrbanVPN2.exe
Token: SeEnableDelegationPrivilege	860	UrbanVPN2.exe
Token: SeManageVolumePrivilege	860	UrbanVPN2.exe
Token: SeImpersonatePrivilege	860	UrbanVPN2.exe
Token: SeCreateGlobalPrivilege	860	UrbanVPN2.exe
Token: SeCreateTokenPrivilege	860	UrbanVPN2.exe
Token: SeAssignPrimaryTokenPrivilege	860	UrbanVPN2.exe
Token: SeLockMemoryPrivilege	860	UrbanVPN2.exe
Token: SeIncreaseQuotaPrivilege	860	UrbanVPN2.exe
Token: SeMachineAccountPrivilege	860	UrbanVPN2.exe
Token: SeTcbPrivilege	860	UrbanVPN2.exe
Token: SeSecurityPrivilege	860	UrbanVPN2.exe
Token: SeTakeOwnershipPrivilege	860	UrbanVPN2.exe
Token: SeLoadDriverPrivilege	860	UrbanVPN2.exe
Token: SeSystemProfilePrivilege	860	UrbanVPN2.exe
Token: SeSystemtimePrivilege	860	UrbanVPN2.exe
Token: SeProfSingleProcessPrivilege	860	UrbanVPN2.exe
Token: SeIncBasePriorityPrivilege	860	UrbanVPN2.exe
Token: SeCreatePagefilePrivilege	860	UrbanVPN2.exe
Token: SeCreatePermanentPrivilege	860	UrbanVPN2.exe
Token: SeBackupPrivilege	860	UrbanVPN2.exe
Token: SeRestorePrivilege	860	UrbanVPN2.exe
Token: SeShutdownPrivilege	860	UrbanVPN2.exe
Token: SeDebugPrivilege	860	UrbanVPN2.exe
Token: SeAuditPrivilege	860	UrbanVPN2.exe
Token: SeSystemEnvironmentPrivilege	860	UrbanVPN2.exe
Token: SeChangeNotifyPrivilege	860	UrbanVPN2.exe
Token: SeRemoteShutdownPrivilege	860	UrbanVPN2.exe
Token: SeUndockPrivilege	860	UrbanVPN2.exe
Token: SeSyncAgentPrivilege	860	UrbanVPN2.exe
Token: SeEnableDelegationPrivilege	860	UrbanVPN2.exe
Token: SeManageVolumePrivilege	860	UrbanVPN2.exe
Token: SeImpersonatePrivilege	860	UrbanVPN2.exe
Token: SeCreateGlobalPrivilege	860	UrbanVPN2.exe
Token: SeCreateTokenPrivilege	860	UrbanVPN2.exe
Token: SeAssignPrimaryTokenPrivilege	860	UrbanVPN2.exe
Token: SeLockMemoryPrivilege	860	UrbanVPN2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
860	UrbanVPN2.exe
2312	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
860	UrbanVPN2.exe
860	UrbanVPN2.exe
2312	iexplore.exe
2312	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1984	1096	msiexec.exe	28
PID 1096 wrote to memory of 1984	1096	msiexec.exe	28
PID 1096 wrote to memory of 1984	1096	msiexec.exe	28
PID 1096 wrote to memory of 1984	1096	msiexec.exe	28
PID 1096 wrote to memory of 1984	1096	msiexec.exe	28
PID 1096 wrote to memory of 1984	1096	msiexec.exe	28
PID 1096 wrote to memory of 1984	1096	msiexec.exe	28
PID 860 wrote to memory of 2000	860	UrbanVPN2.exe	30
PID 860 wrote to memory of 2000	860	UrbanVPN2.exe	30
PID 860 wrote to memory of 2000	860	UrbanVPN2.exe	30
PID 860 wrote to memory of 2000	860	UrbanVPN2.exe	30
PID 860 wrote to memory of 2000	860	UrbanVPN2.exe	30
PID 860 wrote to memory of 2000	860	UrbanVPN2.exe	30
PID 860 wrote to memory of 2000	860	UrbanVPN2.exe	30
PID 1096 wrote to memory of 664	1096	msiexec.exe	34
PID 1096 wrote to memory of 664	1096	msiexec.exe	34
PID 1096 wrote to memory of 664	1096	msiexec.exe	34
PID 1096 wrote to memory of 664	1096	msiexec.exe	34
PID 1096 wrote to memory of 664	1096	msiexec.exe	34
PID 1096 wrote to memory of 664	1096	msiexec.exe	34
PID 1096 wrote to memory of 664	1096	msiexec.exe	34
PID 1096 wrote to memory of 1104	1096	msiexec.exe	35
PID 1096 wrote to memory of 1104	1096	msiexec.exe	35
PID 1096 wrote to memory of 1104	1096	msiexec.exe	35
PID 1096 wrote to memory of 1104	1096	msiexec.exe	35
PID 1096 wrote to memory of 1104	1096	msiexec.exe	35
PID 1096 wrote to memory of 1760	1096	msiexec.exe	37
PID 1096 wrote to memory of 1760	1096	msiexec.exe	37
PID 1096 wrote to memory of 1760	1096	msiexec.exe	37
PID 1096 wrote to memory of 1760	1096	msiexec.exe	37
PID 1760 wrote to memory of 1492	1760	MSIC881.tmp	38
PID 1760 wrote to memory of 1492	1760	MSIC881.tmp	38
PID 1760 wrote to memory of 1492	1760	MSIC881.tmp	38
PID 1760 wrote to memory of 1492	1760	MSIC881.tmp	38
PID 1760 wrote to memory of 1296	1760	MSIC881.tmp	40
PID 1760 wrote to memory of 1296	1760	MSIC881.tmp	40
PID 1760 wrote to memory of 1296	1760	MSIC881.tmp	40
PID 1760 wrote to memory of 1296	1760	MSIC881.tmp	40
PID 2064 wrote to memory of 2088	2064	DrvInst.exe	43
PID 2064 wrote to memory of 2088	2064	DrvInst.exe	43
PID 2064 wrote to memory of 2088	2064	DrvInst.exe	43
PID 1096 wrote to memory of 2268	1096	msiexec.exe	45
PID 1096 wrote to memory of 2268	1096	msiexec.exe	45
PID 1096 wrote to memory of 2268	1096	msiexec.exe	45
PID 1096 wrote to memory of 2268	1096	msiexec.exe	45
PID 1096 wrote to memory of 2268	1096	msiexec.exe	45
PID 1096 wrote to memory of 2268	1096	msiexec.exe	45
PID 1096 wrote to memory of 2268	1096	msiexec.exe	45
PID 2312 wrote to memory of 2364	2312	iexplore.exe	47
PID 2312 wrote to memory of 2364	2312	iexplore.exe	47
PID 2312 wrote to memory of 2364	2312	iexplore.exe	47
PID 2312 wrote to memory of 2364	2312	iexplore.exe	47
PID 1096 wrote to memory of 2512	1096	msiexec.exe	49
PID 1096 wrote to memory of 2512	1096	msiexec.exe	49
PID 1096 wrote to memory of 2512	1096	msiexec.exe	49
PID 1096 wrote to memory of 2512	1096	msiexec.exe	49
PID 1096 wrote to memory of 2512	1096	msiexec.exe	49
PID 1096 wrote to memory of 2512	1096	msiexec.exe	49
PID 1096 wrote to memory of 2512	1096	msiexec.exe	49
PID 1096 wrote to memory of 2568	1096	msiexec.exe	50
PID 1096 wrote to memory of 2568	1096	msiexec.exe	50
PID 1096 wrote to memory of 2568	1096	msiexec.exe	50
PID 1096 wrote to memory of 2568	1096	msiexec.exe	50
PID 1096 wrote to memory of 2568	1096	msiexec.exe	50

C:\Users\Admin\AppData\Local\Temp\UrbanVPN2.exe
"C:\Users\Admin\AppData\Local\Temp\UrbanVPN2.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\UrbanVPN2.exe
  "C:\Users\Admin\AppData\Local\Temp\UrbanVPN2.exe" /i "C:\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.7\install\B71F20E\urbanvpninstaller.x64.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\UrbanVPN" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UrbanVPN" SECONDSEQUENCE="1" CLIENTPROCESSID="860" AI_MORE_CMD_LINE=1
  2⤵
  - Enumerates connected drives
  PID:2000

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 343C8C00DFDCDDAD81A7DEA3E923F5BA C
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 515B81514DB171209FE827CFB7F60F91
  2⤵
  - Loads dropped DLL
  PID:664
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 0381C98533A5321F6B80FC7D5822139D
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:1104
- C:\Windows\Installer\MSIC881.tmp
  "C:\Windows\Installer\MSIC881.tmp" /S /SELECT_UTILITIES=1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Program Files\TAP-Windows\bin\tapinstall.exe
    "C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
    3⤵
    - Executes dropped EXE
    PID:1492
- - C:\Program Files\TAP-Windows\bin\tapinstall.exe
    "C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies system certificate store
    PID:1296
- C:\Windows\Installer\MSIF11B.tmp
  "C:\Windows\Installer\MSIF11B.tmp" https://www.urban-vpn.com/install-desk/
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  PID:2268
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 639DC2971715D809BB5905D049866DD0 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:2512
- C:\Program Files\UrbanVPN\UrbanVPNUpdater.exe
  "C:\Program Files\UrbanVPN\UrbanVPNUpdater.exe" /configservice -name "UrbanVPNUpdater"
  2⤵
  - Executes dropped EXE
  PID:2568

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1948

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004AC" "00000000000002C4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1272

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{42e54052-da72-44df-4f79-3102a9829920}\oemvista.inf" "9" "6d14a44ff" "00000000000002C4" "WinSta0\Default" "00000000000003D0" "208" "c:\program files\tap-windows\driver"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{53a01722-798c-08f9-febc-227013b9a60c} Global\{179533e9-b6d1-09b8-6139-7a3d2d250731} C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{589cd473-7cf3-49d7-a159-451fc4f2ea10}\tap0901.cat
  2⤵
  PID:2088

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:tap0901.NTamd64:tap0901.ndi:9.24.2.601:tap0901" "6d14a44ff" "00000000000002C4" "00000000000005E0" "00000000000005D4"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2140

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2312 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - NTFS ADS
  - Suspicious use of SetWindowsHookEx
  PID:2364

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:2604

C:\Windows\system32\perfmon.exe
"C:\Windows\system32\perfmon.exe" /res
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
da5a9f149955d936a31dc5e456666aac

SHA1
195238d41c1e13448f349f43bb295ef2d55cb47a

SHA256
79ac574c7c45144bb35b59ff79c78dc59b66592715dea01b389e3620db663224

SHA512
60d7d1f5405470ba1e6b80066af2e78240acbea8db58b5a03660874605178aebaa9ce342ca97f17798109e7411e82466db5af064e39eaddc05410f2abe672f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_731B836F03B166238E2AC93FBDDF5EBE

Filesize
727B

MD5
a5131da706828927808e8f0fa80bf4c3

SHA1
eda03778760da28f9f29e9f00813049998f7e330

SHA256
97eff790b317901f30fa83051c94529ef7845fba881db67c53d88d401ab21992

SHA512
a5b15c77641d90cd28ada8a91b805748e92b19dd2c55e2cb97f3aec8a13a267ea78baed5fe52e204a1b740b7dd82fbfbc01ea6c57d661ea8dd0237d0577cc4cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
10ff46a75fd75469cc7cfc5f162861ef

SHA1
e9b09324dc33f72a8a4a72bcab5bcc51987594e3

SHA256
2148c5a31317633604abb1a0f69791e84accb6c37c5366c2fcda6a5b71a47e69

SHA512
86a3a309445e68d5cdc17e7f28bd763612b5ed862004aaa54e2123170bccc4edb5af3428f5ae6ec9e0b52abf90f276662f36cc1bd2ecd1e479c901f52eda1d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
8608e78a8f7e5364336e23174a928a7b

SHA1
442e3acca54bb029bfbb262bcf5819ecf756fecf

SHA256
ac3f6dbc14386675cf876a79283eec1fe04e3cbefd41465690c891f7f34a6f63

SHA512
72e85c8e0df41f079f59f73eec2f636a7ba5deb2be2a40ca53232e89e5795e6569c9e60b1542a529b274c24ac42c7b7a45e09716fb675e5b084469837b483f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_731B836F03B166238E2AC93FBDDF5EBE

Filesize
438B

MD5
dd753dbc726705445ccef4973410df3a

SHA1
5cce40b2dda3e676dbdab372078f7f41e4849aa6

SHA256
64ec0f11f08275612553e405e540b4d94010187d237a946ba54606aa33740568

SHA512
9b729abbb242a58b919da3ffcb39b183df9ea7078bef22162e607d8de39bb270bd4885aabd0656e630b1c3edf9c443b766bed7314d7b4e6c7f1578ac6041d6c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
34d77944f0624c2600a71e3a19403c9a

SHA1
ea2f4be1bb8f18ea837860f95cabc48d9c30faf1

SHA256
c5a0ac7ae8ab975b4482c34916da5754a7ac856b123308618b0219157d5a4a91

SHA512
e5a687a45eb5dd4be1b4628eec2a943256d7bac3e98659e07afa0ba291794d3bb982488de09ffa4e80a49003505e53a15c8f81de4f9a499331c4097f80c0f4f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
442B

MD5
70e5854694516beadc728d177b2b527a

SHA1
86699e9899ddad685727ca56ac50930f6619af7f

SHA256
88397da25c64ce534e766808e18b4dcf37ad7b7a42ce6331681ec60f26740836

SHA512
f9ecb37415e4bca96c597c7d34acdc535c7dc02696cdb94f56be73e6ce93064208d10e074cb2daa26ea70a5b706c73ca407a044dabc241e3b693991bf0aaa566

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI102F.tmp

Filesize
912KB

MD5
b15dbf4b35cd1460ba283795e24878c8

SHA1
327812be4bfdce7a87cb00fab432ecc0d8c38c1e

SHA256
0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147

SHA512
95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1242.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI12B0.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI130F.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI17A2.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI1810.tmp

Filesize
912KB

MD5
b15dbf4b35cd1460ba283795e24878c8

SHA1
327812be4bfdce7a87cb00fab432ecc0d8c38c1e

SHA256
0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147

SHA512
95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI18FB.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI195A.tmp

Filesize
196KB

MD5
efa1291d4eb0ff2050967dd63bfdbdc8

SHA1
54ba41d5a6fb192267b36127ff573cb112413fd8

SHA256
da78931d835e91c59cadaebc95fbae56020ce5031523a6a175fefa4582334ac4

SHA512
5fcce6422b0ee6827a57c5d0c476e36a5e75a880550b8041a0f3db42b630f483654508a797421ff4316fd84db549c8c78536a25d5da2de9eb60365720517d5e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIED6.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\Urban_TOS.html

Filesize
24KB

MD5
993c38c176078ec82cf3d5e21e24cdc0

SHA1
153b97b354ee42cce9dce40b9559577bf37ec303

SHA256
34a4cfe3fbf3172596a779b960b6f92702137ec2d005d144a5d5fd41b7d64221

SHA512
6e52a2be3d012411cb51148a13e554e3b87d3fb278f898e0bc510ba4c23172623c79857da66c2f10b8957e542674c1fd7a24d99bcde8b1e37031055060910e59

Download Submit
C:\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.7\install\B71F20E\urbanvpninstaller.x64.msi

Filesize
7.4MB

MD5
56d54563436370c36600741dcfb0d7eb

SHA1
843f7b8122f8a84259a8aebe3811bb8c01880ec7

SHA256
5af61bbb490ca7b81f63417013763d7130e632c894addeb95dcaa4e8d6207986

SHA512
11262e77fba6b5fe3c488a6f9b46366d708db9c5a33a2414c2351c24e871c986ac57f67f911790562c408a53cc6b0d74ea2f463f5db3a47eb02324b439c8c539

Download Submit
C:\Windows\Installer\MSIA595.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSIAA19.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
C:\Windows\Installer\MSIAAB6.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSIB207.tmp

Filesize
196KB

MD5
efa1291d4eb0ff2050967dd63bfdbdc8

SHA1
54ba41d5a6fb192267b36127ff573cb112413fd8

SHA256
da78931d835e91c59cadaebc95fbae56020ce5031523a6a175fefa4582334ac4

SHA512
5fcce6422b0ee6827a57c5d0c476e36a5e75a880550b8041a0f3db42b630f483654508a797421ff4316fd84db549c8c78536a25d5da2de9eb60365720517d5e6

Download Submit
C:\Windows\Installer\MSIB236.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSIB2B4.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSIB40C.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSIB796.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSIB7D6.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSIBB5F.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
C:\Windows\Installer\MSIC494.tmp

Filesize
663KB

MD5
6950f177eb013280acf3b44b0235f728

SHA1
c918561fd1d1a0b9bdda6ab46574cc20f4054e06

SHA256
4b390231ff40cecdfd21a2817aba3bb04f283018735f14a6b3956656bd334d76

SHA512
44a4e1df1b16cf85b2db26033ad34c1871ba42603bdb2ee20ece9c012ce0f24b4fa31421cb35a2975f75a62584a6b7d477cf704ff461379e3f5e28755cec02bf

Download Submit
C:\Windows\Installer\MSIC521.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSIC6A9.tmp

Filesize
284KB

MD5
e00a2d2e343f66d2325929bf99b0a446

SHA1
8ea50b11013a70afcbfc14396b09d432af7ed328

SHA256
d61b87cad6cda7962d80686ff2a7d529201ade8e99f7f09e6d3bdc22607cdb6d

SHA512
4221df8a5fa3efae28b9d43845cc8961e192f93cf64975d9bab35f01a2bdfb1fc74dcc6651cab3e3f2f87717f8dcdd1bf6794b7552373d325ff8c5d6a4d26e4c

Download Submit
C:\Windows\Installer\MSIC6E9.tmp

Filesize
284KB

MD5
e00a2d2e343f66d2325929bf99b0a446

SHA1
8ea50b11013a70afcbfc14396b09d432af7ed328

SHA256
d61b87cad6cda7962d80686ff2a7d529201ade8e99f7f09e6d3bdc22607cdb6d

SHA512
4221df8a5fa3efae28b9d43845cc8961e192f93cf64975d9bab35f01a2bdfb1fc74dcc6651cab3e3f2f87717f8dcdd1bf6794b7552373d325ff8c5d6a4d26e4c

Download Submit
C:\Windows\Installer\MSIC776.tmp

Filesize
326KB

MD5
216ae6de8351d0d2220204408ea7fce0

SHA1
6f6086b2b1eb1fc0578cd22a3698ff0db79e13d8

SHA256
31070dbd98096c51a431c28c95bc7e0585c2f9ac61523d8cdbe0c5e678fc9be6

SHA512
e714ffd857dc4bec0744388bb156abd4c44d6043d0043f5079de23036d0eaecbef8292c6793f8a917a45b6352a6c59da5c85ba1acfbca0dbf5d986d3dd90f13a

Download Submit
C:\Windows\Installer\MSIC7D5.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSIC881.tmp

Filesize
561KB

MD5
df2dfcd6d8a69c2799a43baf80d34047

SHA1
f0fd7873544739a0cac4cf93e446efe629c00668

SHA256
35cfa71fe2952192c13cbbd8a2f3f62a6486af406008e654646ea1d823928d46

SHA512
e4d7aab39539c7020538a5d26554e52fb23a365d6b8276a10ea25bb4067a04c5e40417cd54c73d8686d6023597b2be0ee138960428c7ca1d791620d5464d3764

Download Submit
C:\Windows\Installer\MSIC881.tmp

Filesize
561KB

MD5
df2dfcd6d8a69c2799a43baf80d34047

SHA1
f0fd7873544739a0cac4cf93e446efe629c00668

SHA256
35cfa71fe2952192c13cbbd8a2f3f62a6486af406008e654646ea1d823928d46

SHA512
e4d7aab39539c7020538a5d26554e52fb23a365d6b8276a10ea25bb4067a04c5e40417cd54c73d8686d6023597b2be0ee138960428c7ca1d791620d5464d3764

Download Submit
\Users\Admin\AppData\Local\Temp\MSI102F.tmp

Filesize
912KB

MD5
b15dbf4b35cd1460ba283795e24878c8

SHA1
327812be4bfdce7a87cb00fab432ecc0d8c38c1e

SHA256
0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147

SHA512
95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4

Download Submit
\Users\Admin\AppData\Local\Temp\MSI1242.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
\Users\Admin\AppData\Local\Temp\MSI12B0.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
\Users\Admin\AppData\Local\Temp\MSI130F.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
\Users\Admin\AppData\Local\Temp\MSI17A2.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
\Users\Admin\AppData\Local\Temp\MSI1810.tmp

Filesize
912KB

MD5
b15dbf4b35cd1460ba283795e24878c8

SHA1
327812be4bfdce7a87cb00fab432ecc0d8c38c1e

SHA256
0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147

SHA512
95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4

Download Submit
\Users\Admin\AppData\Local\Temp\MSI18FB.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
\Users\Admin\AppData\Local\Temp\MSI195A.tmp

Filesize
196KB

MD5
efa1291d4eb0ff2050967dd63bfdbdc8

SHA1
54ba41d5a6fb192267b36127ff573cb112413fd8

SHA256
da78931d835e91c59cadaebc95fbae56020ce5031523a6a175fefa4582334ac4

SHA512
5fcce6422b0ee6827a57c5d0c476e36a5e75a880550b8041a0f3db42b630f483654508a797421ff4316fd84db549c8c78536a25d5da2de9eb60365720517d5e6

Download Submit
\Users\Admin\AppData\Local\Temp\MSIED6.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.7\install\decoder.dll

Filesize
206KB

MD5
899944fb96ccc34cfbd2ccb9134367c5

SHA1
7c46aa3f84ba5da95ceff39cd49185672f963538

SHA256
780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259

SHA512
2c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0

Download Submit
\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.7\install\decoder.dll

Filesize
206KB

MD5
899944fb96ccc34cfbd2ccb9134367c5

SHA1
7c46aa3f84ba5da95ceff39cd49185672f963538

SHA256
780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259

SHA512
2c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0

Download Submit
\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.7\install\decoder.dll

Filesize
206KB

MD5
899944fb96ccc34cfbd2ccb9134367c5

SHA1
7c46aa3f84ba5da95ceff39cd49185672f963538

SHA256
780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259

SHA512
2c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0

Download Submit
\Windows\Installer\MSIA595.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
\Windows\Installer\MSIAA19.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
\Windows\Installer\MSIAAB6.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
\Windows\Installer\MSIB207.tmp

Filesize
196KB

MD5
efa1291d4eb0ff2050967dd63bfdbdc8

SHA1
54ba41d5a6fb192267b36127ff573cb112413fd8

SHA256
da78931d835e91c59cadaebc95fbae56020ce5031523a6a175fefa4582334ac4

SHA512
5fcce6422b0ee6827a57c5d0c476e36a5e75a880550b8041a0f3db42b630f483654508a797421ff4316fd84db549c8c78536a25d5da2de9eb60365720517d5e6

Download Submit
\Windows\Installer\MSIB236.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
\Windows\Installer\MSIB2B4.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
\Windows\Installer\MSIB40C.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
\Windows\Installer\MSIB796.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
\Windows\Installer\MSIB7D6.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
\Windows\Installer\MSIBB5F.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
\Windows\Installer\MSIC494.tmp

Filesize
663KB

MD5
6950f177eb013280acf3b44b0235f728

SHA1
c918561fd1d1a0b9bdda6ab46574cc20f4054e06

SHA256
4b390231ff40cecdfd21a2817aba3bb04f283018735f14a6b3956656bd334d76

SHA512
44a4e1df1b16cf85b2db26033ad34c1871ba42603bdb2ee20ece9c012ce0f24b4fa31421cb35a2975f75a62584a6b7d477cf704ff461379e3f5e28755cec02bf

Download Submit
\Windows\Installer\MSIC521.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
\Windows\Installer\MSIC6A9.tmp

Filesize
284KB

MD5
e00a2d2e343f66d2325929bf99b0a446

SHA1
8ea50b11013a70afcbfc14396b09d432af7ed328

SHA256
d61b87cad6cda7962d80686ff2a7d529201ade8e99f7f09e6d3bdc22607cdb6d

SHA512
4221df8a5fa3efae28b9d43845cc8961e192f93cf64975d9bab35f01a2bdfb1fc74dcc6651cab3e3f2f87717f8dcdd1bf6794b7552373d325ff8c5d6a4d26e4c

Download Submit
\Windows\Installer\MSIC6E9.tmp

Filesize
284KB

MD5
e00a2d2e343f66d2325929bf99b0a446

SHA1
8ea50b11013a70afcbfc14396b09d432af7ed328

SHA256
d61b87cad6cda7962d80686ff2a7d529201ade8e99f7f09e6d3bdc22607cdb6d

SHA512
4221df8a5fa3efae28b9d43845cc8961e192f93cf64975d9bab35f01a2bdfb1fc74dcc6651cab3e3f2f87717f8dcdd1bf6794b7552373d325ff8c5d6a4d26e4c

Download Submit
\Windows\Installer\MSIC776.tmp

Filesize
326KB

MD5
216ae6de8351d0d2220204408ea7fce0

SHA1
6f6086b2b1eb1fc0578cd22a3698ff0db79e13d8

SHA256
31070dbd98096c51a431c28c95bc7e0585c2f9ac61523d8cdbe0c5e678fc9be6

SHA512
e714ffd857dc4bec0744388bb156abd4c44d6043d0043f5079de23036d0eaecbef8292c6793f8a917a45b6352a6c59da5c85ba1acfbca0dbf5d986d3dd90f13a

Download Submit
\Windows\Installer\MSIC7D5.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
memory/860-90-0x0000000070511000-0x0000000070513000-memory.dmp

Filesize
8KB

Download
memory/860-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1096-57-0x000007FEFB751000-0x000007FEFB753000-memory.dmp

Filesize
8KB

Download
memory/1184-155-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1184-156-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1184-153-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1184-154-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download