581eba8772a2cf1acabba4094c391034812bb98a5abd91725dfd917c44d8c44c

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2022 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UrbanVPN2.exe
Size

30.7MB
MD5

7274b344c614f2fe405dbffadccfbab1
SHA1

d2bf8dc3285ce0a5f1a87234e9ac21bee9c72a3c
SHA256

581eba8772a2cf1acabba4094c391034812bb98a5abd91725dfd917c44d8c44c
SHA512

aacf19dfa044a710a774475f61853a408c552a8e5858e349bf3e1dac96bec639c8ca555b027b1dd6515f925959ff7b66e2d0141afbfdfdd3019b71ac93437854
SSDEEP

786432:dtiCbhe50g0+efDnNqc7r1fQFfCxkdc0yQJ:I50kefDnNqirFwCx0pZ

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

MsiExec.exe

flow pid process

50 2424 MsiExec.exe
51 2424 MsiExec.exe
50 2424 MsiExec.exe
51 2424 MsiExec.exe

flow	pid	process
50	2424	MsiExec.exe
51	2424	MsiExec.exe
50	2424	MsiExec.exe
51	2424	MsiExec.exe

Drops file in Drivers directory 3 IoCs

Processes:

DrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET2844.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET2844.tmp	DrvInst.exe

Executes dropped EXE 6 IoCs

Processes:

MSI1F5F.tmptapinstall.exetapinstall.exeMSI2CFF.tmpUrbanVPNUpdater.exeurbanvpnserv.exe

pid process

4972 MSI1F5F.tmp
1952 tapinstall.exe
2856 tapinstall.exe
4088 MSI2CFF.tmp
5088 UrbanVPNUpdater.exe
2572 urbanvpnserv.exe

pid	process
4972	MSI1F5F.tmp
1952	tapinstall.exe
2856	tapinstall.exe
4088	MSI2CFF.tmp
5088	UrbanVPNUpdater.exe
2572	urbanvpnserv.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

UrbanVPN2.exeMSI2CFF.tmp

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	UrbanVPN2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	MSI2CFF.tmp

Loads dropped DLL 51 IoCs

Processes:

UrbanVPN2.exeMsiExec.exeMsiExec.exeMsiExec.exeMSI1F5F.tmpMsiExec.exeurbanvpnserv.exe

pid	process
4904	UrbanVPN2.exe
4904	UrbanVPN2.exe
4904	UrbanVPN2.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
2424	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
2424	MsiExec.exe
2424	MsiExec.exe
2424	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
4904	UrbanVPN2.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
4972	MSI1F5F.tmp
4972	MSI1F5F.tmp
4972	MSI1F5F.tmp
4972	MSI1F5F.tmp
4972	MSI1F5F.tmp
4972	MSI1F5F.tmp
1940	MsiExec.exe
2424	MsiExec.exe
2424	MsiExec.exe
512	MsiExec.exe
512	MsiExec.exe
512	MsiExec.exe
2572	urbanvpnserv.exe
1940	MsiExec.exe
512	MsiExec.exe
1940	MsiExec.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msiexec.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UrbanVPN = "C:\\Program Files\\UrbanVPN\\UrbanVPNUpdater.exe /checknow -minuseractions -startappfirst -restartapp \"C:\\Program Files\\UrbanVPN\\bin\\urbanvpn-gui.exe\" "	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

MsiExec.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini MsiExec.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

UrbanVPN2.exeUrbanVPN2.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\W:	UrbanVPN2.exe
File opened (read-only)	\??\F:	UrbanVPN2.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	UrbanVPN2.exe
File opened (read-only)	\??\G:	UrbanVPN2.exe
File opened (read-only)	\??\Z:	UrbanVPN2.exe
File opened (read-only)	\??\O:	UrbanVPN2.exe
File opened (read-only)	\??\S:	UrbanVPN2.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	UrbanVPN2.exe
File opened (read-only)	\??\N:	UrbanVPN2.exe
File opened (read-only)	\??\G:	UrbanVPN2.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	UrbanVPN2.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\L:	UrbanVPN2.exe
File opened (read-only)	\??\Q:	UrbanVPN2.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	UrbanVPN2.exe
File opened (read-only)	\??\Q:	UrbanVPN2.exe
File opened (read-only)	\??\Y:	UrbanVPN2.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	UrbanVPN2.exe
File opened (read-only)	\??\P:	UrbanVPN2.exe
File opened (read-only)	\??\N:	UrbanVPN2.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	UrbanVPN2.exe
File opened (read-only)	\??\R:	UrbanVPN2.exe
File opened (read-only)	\??\U:	UrbanVPN2.exe
File opened (read-only)	\??\E:	UrbanVPN2.exe
File opened (read-only)	\??\I:	UrbanVPN2.exe
File opened (read-only)	\??\X:	UrbanVPN2.exe
File opened (read-only)	\??\T:	UrbanVPN2.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	UrbanVPN2.exe
File opened (read-only)	\??\L:	UrbanVPN2.exe
File opened (read-only)	\??\M:	UrbanVPN2.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	UrbanVPN2.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	UrbanVPN2.exe
File opened (read-only)	\??\B:	UrbanVPN2.exe
File opened (read-only)	\??\K:	UrbanVPN2.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	UrbanVPN2.exe
File opened (read-only)	\??\K:	UrbanVPN2.exe
File opened (read-only)	\??\V:	UrbanVPN2.exe
File opened (read-only)	\??\Z:	UrbanVPN2.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	UrbanVPN2.exe
File opened (read-only)	\??\T:	UrbanVPN2.exe
File opened (read-only)	\??\V:	UrbanVPN2.exe
File opened (read-only)	\??\F:	UrbanVPN2.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	UrbanVPN2.exe
File opened (read-only)	\??\Y:	UrbanVPN2.exe

Drops file in System32 directory 16 IoCs

Processes:

DrvInst.exetapinstall.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\Temp\{6a3fa6c5-3773-1d4f-9167-188780ed864d}\SET244C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6a3fa6c5-3773-1d4f-9167-188780ed864d}\SET245E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6a3fa6c5-3773-1d4f-9167-188780ed864d}\SET244C.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{6a3fa6c5-3773-1d4f-9167-188780ed864d}\SET245D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6a3fa6c5-3773-1d4f-9167-188780ed864d}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6a3fa6c5-3773-1d4f-9167-188780ed864d}\SET245D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{6a3fa6c5-3773-1d4f-9167-188780ed864d}\SET245E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\oemvista.PNF	tapinstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6a3fa6c5-3773-1d4f-9167-188780ed864d}\oemvista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6a3fa6c5-3773-1d4f-9167-188780ed864d}\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\oemvista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{6a3fa6c5-3773-1d4f-9167-188780ed864d}\tap0901.cat	DrvInst.exe

Drops file in Program Files directory 22 IoCs

Processes:

MSI1F5F.tmpmsiexec.exeidentity_helper.exe

description	ioc	process
File created	C:\Program Files\TAP-Windows\driver\tap0901.sys	MSI1F5F.tmp
File created	C:\Program Files\TAP-Windows\bin\addtap.bat	MSI1F5F.tmp
File created	C:\Program Files\TAP-Windows\license.txt	MSI1F5F.tmp
File created	C:\Program Files\TAP-Windows\Uninstall.exe	MSI1F5F.tmp
File created	C:\Program Files\UrbanVPN\bin\liblzo2-2.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\libcrypto-1_1-x64.dll	msiexec.exe
File created	C:\Program Files\TAP-Windows\bin\tapinstall.exe	MSI1F5F.tmp
File created	C:\Program Files\TAP-Windows\driver\tap0901.cat	MSI1F5F.tmp
File created	C:\Program Files\UrbanVPN\bin\urbanvpn.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\urbanvpn-gui.exe	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\libpkcs11-helper-1.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\UrbanVPNUpdater.exe	msiexec.exe
File created	C:\Program Files\TAP-Windows\driver\OemVista.inf	MSI1F5F.tmp
File created	C:\Program Files\UrbanVPN\bin\urbanvpn.exe	msiexec.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\61f10dbb-2185-41e9-b342-6e0729173e36.tmp	identity_helper.exe
File created	C:\Program Files\UrbanVPN\bin\urbanvpnserv.exe	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\libssl-1_1-x64.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\openssl.exe	msiexec.exe
File opened for modification	C:\Program Files\UrbanVPN\UrbanVPNUpdater.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20221001104042.pma	identity_helper.exe
File created	C:\Program Files\TAP-Windows\bin\deltapall.bat	MSI1F5F.tmp
File created	C:\Program Files\TAP-Windows\icon.ico	MSI1F5F.tmp

Drops file in Windows directory 47 IoCs

Processes:

msiexec.exeDrvInst.exeDrvInst.exesvchost.exetapinstall.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI2C81.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E5.tmp	msiexec.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2B57.tmp	msiexec.exe
File created	C:\Windows\Installer\{D19B15C9-1BAA-471D-B431-6511CFEC3FEE}\urbanvpngui_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D51.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI947.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D87.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F5F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2CFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A9E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CF1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI54D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI190D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E82.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3434.tmp	msiexec.exe
File created	C:\Windows\Installer\e57fed4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBAE.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\MSI977.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB00.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3F.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D19B15C9-1BAA-471D-B431-6511CFEC3FEE}	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\Installer\MSI36E4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e57fed2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI194D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1C2D.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI2AF8.tmp	msiexec.exe
File created	C:\Windows\Installer\e57fed2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI196D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E7B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D31.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB7F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D76.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1EE1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{D19B15C9-1BAA-471D-B431-6511CFEC3FEE}\urbanvpngui_1.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 1 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.8\install\FEC3FEE\urbanvpninstaller.x64.msi	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DrvInst.exetapinstall.exesvchost.exeDrvInst.exetapinstall.exevssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tapinstall.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000007c4a2b5d7b48cb040000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800007c4a2b5d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809007c4a2b5d000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007c4a2b5d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000007c4a2b5d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	tapinstall.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 56 Go-http-client/1.1
HTTP User-Agent header 58 Go-http-client/1.1
HTTP User-Agent header 129 Go-http-client/1.1

description	flow	ioc
HTTP User-Agent header	56	Go-http-client/1.1
HTTP User-Agent header	58	Go-http-client/1.1
HTTP User-Agent header	129	Go-http-client/1.1

Modifies data under HKEY_USERS 53 IoCs

Processes:

DrvInst.exemsiexec.exeMsiExec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{5d2b4a7c-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{5d2b4a7c-0000-0000-0000-d01200000000}\MaxCapacity = "15140"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{5d2b4a7c-0000-0000-0000-d01200000000}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 27 IoCs

Processes:

msiexec.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9C51B91DAAB1D1744B135611FCCEF3EE\AIOtherFiles	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9C51B91DAAB1D1744B135611FCCEF3EE\AI64BitFiles	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\PackageCode = "5AA31B06276625641A70D1A1FBB34049"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\Version = "33685512"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\ProductIcon = "C:\\Windows\\Installer\\{D19B15C9-1BAA-471D-B431-6511CFEC3FEE}\\urbanvpngui_1.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9C51B91DAAB1D1744B135611FCCEF3EE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\SourceList\PackageName = "urbanvpninstaller.x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D15EE4AAF3E53D9488CC68E460CB755B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\ProductName = "UrbanVPN"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D15EE4AAF3E53D9488CC68E460CB755B\9C51B91DAAB1D1744B135611FCCEF3EE	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Urban Security\\UrbanVPN 2.2.8\\install\\FEC3FEE\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C51B91DAAB1D1744B135611FCCEF3EE\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Urban Security\\UrbanVPN 2.2.8\\install\\FEC3FEE\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9C51B91DAAB1D1744B135611FCCEF3EE\MainFeature	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

UrbanVPN2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	UrbanVPN2.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

MsiExec.exemsiexec.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
1248	MsiExec.exe
4464	msiexec.exe
4464	msiexec.exe
3944	msedge.exe
3944	msedge.exe
1256	msedge.exe
1256	msedge.exe
1680	identity_helper.exe
1680	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

1256 msedge.exe
1256 msedge.exe
1256 msedge.exe
1256 msedge.exe

pid	process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exeUrbanVPN2.exe

description	pid	process
Token: SeSecurityPrivilege	4464	msiexec.exe
Token: SeCreateTokenPrivilege	4904	UrbanVPN2.exe
Token: SeAssignPrimaryTokenPrivilege	4904	UrbanVPN2.exe
Token: SeLockMemoryPrivilege	4904	UrbanVPN2.exe
Token: SeIncreaseQuotaPrivilege	4904	UrbanVPN2.exe
Token: SeMachineAccountPrivilege	4904	UrbanVPN2.exe
Token: SeTcbPrivilege	4904	UrbanVPN2.exe
Token: SeSecurityPrivilege	4904	UrbanVPN2.exe
Token: SeTakeOwnershipPrivilege	4904	UrbanVPN2.exe
Token: SeLoadDriverPrivilege	4904	UrbanVPN2.exe
Token: SeSystemProfilePrivilege	4904	UrbanVPN2.exe
Token: SeSystemtimePrivilege	4904	UrbanVPN2.exe
Token: SeProfSingleProcessPrivilege	4904	UrbanVPN2.exe
Token: SeIncBasePriorityPrivilege	4904	UrbanVPN2.exe
Token: SeCreatePagefilePrivilege	4904	UrbanVPN2.exe
Token: SeCreatePermanentPrivilege	4904	UrbanVPN2.exe
Token: SeBackupPrivilege	4904	UrbanVPN2.exe
Token: SeRestorePrivilege	4904	UrbanVPN2.exe
Token: SeShutdownPrivilege	4904	UrbanVPN2.exe
Token: SeDebugPrivilege	4904	UrbanVPN2.exe
Token: SeAuditPrivilege	4904	UrbanVPN2.exe
Token: SeSystemEnvironmentPrivilege	4904	UrbanVPN2.exe
Token: SeChangeNotifyPrivilege	4904	UrbanVPN2.exe
Token: SeRemoteShutdownPrivilege	4904	UrbanVPN2.exe
Token: SeUndockPrivilege	4904	UrbanVPN2.exe
Token: SeSyncAgentPrivilege	4904	UrbanVPN2.exe
Token: SeEnableDelegationPrivilege	4904	UrbanVPN2.exe
Token: SeManageVolumePrivilege	4904	UrbanVPN2.exe
Token: SeImpersonatePrivilege	4904	UrbanVPN2.exe
Token: SeCreateGlobalPrivilege	4904	UrbanVPN2.exe
Token: SeCreateTokenPrivilege	4904	UrbanVPN2.exe
Token: SeAssignPrimaryTokenPrivilege	4904	UrbanVPN2.exe
Token: SeLockMemoryPrivilege	4904	UrbanVPN2.exe
Token: SeIncreaseQuotaPrivilege	4904	UrbanVPN2.exe
Token: SeMachineAccountPrivilege	4904	UrbanVPN2.exe
Token: SeTcbPrivilege	4904	UrbanVPN2.exe
Token: SeSecurityPrivilege	4904	UrbanVPN2.exe
Token: SeTakeOwnershipPrivilege	4904	UrbanVPN2.exe
Token: SeLoadDriverPrivilege	4904	UrbanVPN2.exe
Token: SeSystemProfilePrivilege	4904	UrbanVPN2.exe
Token: SeSystemtimePrivilege	4904	UrbanVPN2.exe
Token: SeProfSingleProcessPrivilege	4904	UrbanVPN2.exe
Token: SeIncBasePriorityPrivilege	4904	UrbanVPN2.exe
Token: SeCreatePagefilePrivilege	4904	UrbanVPN2.exe
Token: SeCreatePermanentPrivilege	4904	UrbanVPN2.exe
Token: SeBackupPrivilege	4904	UrbanVPN2.exe
Token: SeRestorePrivilege	4904	UrbanVPN2.exe
Token: SeShutdownPrivilege	4904	UrbanVPN2.exe
Token: SeDebugPrivilege	4904	UrbanVPN2.exe
Token: SeAuditPrivilege	4904	UrbanVPN2.exe
Token: SeSystemEnvironmentPrivilege	4904	UrbanVPN2.exe
Token: SeChangeNotifyPrivilege	4904	UrbanVPN2.exe
Token: SeRemoteShutdownPrivilege	4904	UrbanVPN2.exe
Token: SeUndockPrivilege	4904	UrbanVPN2.exe
Token: SeSyncAgentPrivilege	4904	UrbanVPN2.exe
Token: SeEnableDelegationPrivilege	4904	UrbanVPN2.exe
Token: SeManageVolumePrivilege	4904	UrbanVPN2.exe
Token: SeImpersonatePrivilege	4904	UrbanVPN2.exe
Token: SeCreateGlobalPrivilege	4904	UrbanVPN2.exe
Token: SeCreateTokenPrivilege	4904	UrbanVPN2.exe
Token: SeAssignPrimaryTokenPrivilege	4904	UrbanVPN2.exe
Token: SeLockMemoryPrivilege	4904	UrbanVPN2.exe
Token: SeIncreaseQuotaPrivilege	4904	UrbanVPN2.exe
Token: SeMachineAccountPrivilege	4904	UrbanVPN2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

UrbanVPN2.exemsedge.exe

pid process

4904 UrbanVPN2.exe
1256 msedge.exe
1256 msedge.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

UrbanVPN2.exe

pid process

4904 UrbanVPN2.exe
4904 UrbanVPN2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeUrbanVPN2.exeMSI1F5F.tmpsvchost.exeMSI2CFF.tmpmsedge.exe

description	pid	process	target process
PID 4464 wrote to memory of 1248	4464	msiexec.exe	MsiExec.exe
PID 4464 wrote to memory of 1248	4464	msiexec.exe	MsiExec.exe
PID 4464 wrote to memory of 1248	4464	msiexec.exe	MsiExec.exe
PID 4904 wrote to memory of 3760	4904	UrbanVPN2.exe	UrbanVPN2.exe
PID 4904 wrote to memory of 3760	4904	UrbanVPN2.exe	UrbanVPN2.exe
PID 4904 wrote to memory of 3760	4904	UrbanVPN2.exe	UrbanVPN2.exe
PID 4464 wrote to memory of 1484	4464	msiexec.exe	srtasks.exe
PID 4464 wrote to memory of 1484	4464	msiexec.exe	srtasks.exe
PID 4464 wrote to memory of 1940	4464	msiexec.exe	MsiExec.exe
PID 4464 wrote to memory of 1940	4464	msiexec.exe	MsiExec.exe
PID 4464 wrote to memory of 1940	4464	msiexec.exe	MsiExec.exe
PID 4464 wrote to memory of 2424	4464	msiexec.exe	MsiExec.exe
PID 4464 wrote to memory of 2424	4464	msiexec.exe	MsiExec.exe
PID 4464 wrote to memory of 4972	4464	msiexec.exe	MSI1F5F.tmp
PID 4464 wrote to memory of 4972	4464	msiexec.exe	MSI1F5F.tmp
PID 4464 wrote to memory of 4972	4464	msiexec.exe	MSI1F5F.tmp
PID 4972 wrote to memory of 1952	4972	MSI1F5F.tmp	tapinstall.exe
PID 4972 wrote to memory of 1952	4972	MSI1F5F.tmp	tapinstall.exe
PID 4972 wrote to memory of 2856	4972	MSI1F5F.tmp	tapinstall.exe
PID 4972 wrote to memory of 2856	4972	MSI1F5F.tmp	tapinstall.exe
PID 3252 wrote to memory of 2668	3252	svchost.exe	DrvInst.exe
PID 3252 wrote to memory of 2668	3252	svchost.exe	DrvInst.exe
PID 3252 wrote to memory of 3720	3252	svchost.exe	DrvInst.exe
PID 3252 wrote to memory of 3720	3252	svchost.exe	DrvInst.exe
PID 4464 wrote to memory of 4088	4464	msiexec.exe	MSI2CFF.tmp
PID 4464 wrote to memory of 4088	4464	msiexec.exe	MSI2CFF.tmp
PID 4464 wrote to memory of 4088	4464	msiexec.exe	MSI2CFF.tmp
PID 4088 wrote to memory of 1256	4088	MSI2CFF.tmp	msedge.exe
PID 4088 wrote to memory of 1256	4088	MSI2CFF.tmp	msedge.exe
PID 1256 wrote to memory of 2832	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 2832	1256	msedge.exe	msedge.exe
PID 4464 wrote to memory of 512	4464	msiexec.exe	MsiExec.exe
PID 4464 wrote to memory of 512	4464	msiexec.exe	MsiExec.exe
PID 4464 wrote to memory of 512	4464	msiexec.exe	MsiExec.exe
PID 4464 wrote to memory of 5088	4464	msiexec.exe	UrbanVPNUpdater.exe
PID 4464 wrote to memory of 5088	4464	msiexec.exe	UrbanVPNUpdater.exe
PID 4464 wrote to memory of 5088	4464	msiexec.exe	UrbanVPNUpdater.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe
PID 1256 wrote to memory of 4024	1256	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\UrbanVPN2.exe
"C:\Users\Admin\AppData\Local\Temp\UrbanVPN2.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Local\Temp\UrbanVPN2.exe
"C:\Users\Admin\AppData\Local\Temp\UrbanVPN2.exe" /i "C:\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.8\install\FEC3FEE\urbanvpninstaller.x64.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\UrbanVPN" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UrbanVPN" SECONDSEQUENCE="1" CLIENTPROCESSID="4904" AI_MORE_CMD_LINE=1
2⤵
- Enumerates connected drives
PID:3760

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding BACC3A8222E84F974E1277790CDD65ED C
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1248

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:1484

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 80EF4D6AEDBACBF1E1ECCBA04DA3C7FC
2⤵
- Loads dropped DLL
PID:1940

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 87A399D1B0F855792195DFBB1131F6C5
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:2424

C:\Windows\Installer\MSI1F5F.tmp
"C:\Windows\Installer\MSI1F5F.tmp" /S /SELECT_UTILITIES=1
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4972

C:\Program Files\TAP-Windows\bin\tapinstall.exe
"C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1952

C:\Program Files\TAP-Windows\bin\tapinstall.exe
"C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2856

C:\Windows\Installer\MSI2CFF.tmp
"C:\Windows\Installer\MSI2CFF.tmp" https://www.urban-vpn.com/install-desk/
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.urban-vpn.com/install-desk/
3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8ee1546f8,0x7ff8ee154708,0x7ff8ee154718
4⤵
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
4⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2664 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3180 /prefetch:8
4⤵
PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
4⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
4⤵
PID:64

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5476 /prefetch:8
4⤵
PID:512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5828 /prefetch:8
4⤵
PID:4852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
4⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
4⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 /prefetch:8
4⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
4⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6ffa35460,0x7ff6ffa35470,0x7ff6ffa35480
5⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,7898059812680372197,12108434630828999306,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 /prefetch:8
4⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1680

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 63FB4F8F199CFE37BF4EACA28BA90DAA E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
PID:512

C:\Program Files\UrbanVPN\UrbanVPNUpdater.exe
"C:\Program Files\UrbanVPN\UrbanVPNUpdater.exe" /configservice -name "UrbanVPNUpdater"
2⤵
- Executes dropped EXE
PID:5088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3252

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{51d04ecb-e9b4-aa4b-919b-24ba334a5437}\oemvista.inf" "9" "4d14a44ff" "0000000000000140" "WinSta0\Default" "0000000000000160" "208" "c:\program files\tap-windows\driver"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2668

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "0000000000000140"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:3720

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
1⤵
PID:2508

C:\Program Files\UrbanVPN\bin\urbanvpnserv.exe
"C:\Program Files\UrbanVPN\bin\urbanvpnserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
da5a9f149955d936a31dc5e456666aac

SHA1
195238d41c1e13448f349f43bb295ef2d55cb47a

SHA256
79ac574c7c45144bb35b59ff79c78dc59b66592715dea01b389e3620db663224

SHA512
60d7d1f5405470ba1e6b80066af2e78240acbea8db58b5a03660874605178aebaa9ce342ca97f17798109e7411e82466db5af064e39eaddc05410f2abe672f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_731B836F03B166238E2AC93FBDDF5EBE

Filesize
727B

MD5
f7a919c7a59a11573d2e94e532802caa

SHA1
a21ac1bb6642221d412cfa8ec1cabc8afc0fd526

SHA256
636b6338a7e4c1a8041f369af1019679a9b447861c04515d7b8f383c6bf0dd7f

SHA512
ae8f604cffa5f967c47165ec126c03a3e490ef7ff2f386996afeb5a0dc7130c170723cd2df332da12bd1a47322690ac29bb000f8280e2383d00afc2d734d2f95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
f5c29ab5bdf98d9eb64e1468fe980048

SHA1
ffdec5955a44b961f0ade5c955bf273198a32fbe

SHA256
b98eddaf2e1ffa9dab0a6deb7596e926652e8d3112e3724962fbf855f69a22ab

SHA512
7a530401c1441c94bb132e874f9673bd0c919cb1b039353e3e4ebe7e8176ba9b80c0347b595cd661f67594c2f509f125bf1222a7dd9534ead90eadb823c59039

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
783ef52e3587c3119551b5cf067fb522

SHA1
4847e56cf457c2f02ff61b8d5ea8713d71785b6b

SHA256
f560f1f0600d88e4208ac40befeae45e041aedd818892ef2559125710bb7b934

SHA512
cb944fd71f357dbf4e2749d30ef9936525720d1c7c6d323a5fa8bb56441be79b1a73ed17ab702a0c3409971bb7346dab6cd51ff202f26a94d8c423381e3a7ce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_731B836F03B166238E2AC93FBDDF5EBE

Filesize
408B

MD5
7e1b523993e9e4f7eea67a5a93bfc7af

SHA1
6f9303416bd0031b78532b34841464a1c7f9b458

SHA256
61a4f4a6175ff42b40a2346c45c71f49ddd51b8b983591a9ff04439bd43b37aa

SHA512
87823e34cc07931c25d967ab76c60bb2b223b5948c02fb5507d2b0d64254d018710b7c7b8de48b814ad4e1e745698e66e3c419799e62d0259c00aa0665f5242c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
d356340fa47e250177332da616b0772f

SHA1
884e415fb73fa5894bd94292e30e798321824352

SHA256
8f3a7c2d6ce28d4d1483c77e3d3bb539af3cf95b8c9ffbf8fe31716af3929d6f

SHA512
911461346909e26c55ae9b98c641285ef0c509abe5a07158fa3096ab30aae1613e7c61cafc30dda2cb991525b3d5a5758f8c41423e523aa54a911ee28932ae41

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\632040a71cb8de62c9f15f5a\2.2.8\tracking.ini

Filesize
85B

MD5
ceebc6520d671d472de70b37af5d96a8

SHA1
80c52fac6c7ade5586ccfa5288982470c5c9e01b

SHA256
7153c7925afece634c7fa55d2a08d0e46e71e96fa9811c1bdd847b724adb04f3

SHA512
673cba803347c602dd76909ec7a51813ff599316d119bb42949aa4a2c42883edd460f48dbe0bc4a7b7a02033315c6eac871a03a5f78cdec23add493da439d148

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\632040a71cb8de62c9f15f5a\2.2.8\tracking.ini

Filesize
84B

MD5
fbb55d095b6b7838aa0cc8adf87e6aaa

SHA1
ec33732b715d6cc2ac5e8d8fc962718d179ba129

SHA256
1ecb66438b10db707c806c6d77b8afe8fa9ae471d7d6259a21ed0bbe6aaf3d86

SHA512
da0d596fbb21cdf5192c60ea819da59ccc6718f328f5944216cbe4975ee5a8034d1d108c68ad257b8ebcb24241e84849f8d0618fe62950d4096e698a1b5ac91d

Download Submit
C:\Users\Admin\AppData\Local\AdvinstAnalytics\632040a71cb8de62c9f15f5a\2.2.8\{112BB915-2947-449A-AA2B-6C45916727A0}.session

Filesize
4KB

MD5
2d3032f4eec9b98703f345fa51a69cad

SHA1
da53e3be60924ac13e2d1f6ca79f8f7fb0f76bba

SHA256
efab284da588a3a736bf8c8831de8e84154f69a71a67c1fa9fb027783d7d88c2

SHA512
23340045ab4ec30b66509f3c60105c584b51baa02eda7e9af509bba6054e7bd0225e6a54d1b1851aa9835acf3483dbdc809c04016d82b71b15356b48b9304bfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\INAEB10.tmp

Filesize
782KB

MD5
175d9b039177b405ee04c81f4c9aa4af

SHA1
6b523f7652761f4a24cf12ce08a32479ed03e8cf

SHA256
34a742397244bd2848291f7d1087eb43462a69272f22249e24c2aa71e79d14f3

SHA512
80f39a82a12899601da3dfc3092ba7465554b360a741fe26c0e4fbe3fac9b62ddde1f8c50f972eabf982427ac0b120edd67e8be31161a4ce4e2f8ef0dd53b26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEC7A.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIEC7A.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIED84.tmp

Filesize
912KB

MD5
b15dbf4b35cd1460ba283795e24878c8

SHA1
327812be4bfdce7a87cb00fab432ecc0d8c38c1e

SHA256
0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147

SHA512
95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIED84.tmp

Filesize
912KB

MD5
b15dbf4b35cd1460ba283795e24878c8

SHA1
327812be4bfdce7a87cb00fab432ecc0d8c38c1e

SHA256
0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147

SHA512
95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF1FA.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF1FA.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF268.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF268.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF289.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF289.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF299.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF299.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF5C7.tmp

Filesize
782KB

MD5
175d9b039177b405ee04c81f4c9aa4af

SHA1
6b523f7652761f4a24cf12ce08a32479ed03e8cf

SHA256
34a742397244bd2848291f7d1087eb43462a69272f22249e24c2aa71e79d14f3

SHA512
80f39a82a12899601da3dfc3092ba7465554b360a741fe26c0e4fbe3fac9b62ddde1f8c50f972eabf982427ac0b120edd67e8be31161a4ce4e2f8ef0dd53b26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF5C7.tmp

Filesize
782KB

MD5
175d9b039177b405ee04c81f4c9aa4af

SHA1
6b523f7652761f4a24cf12ce08a32479ed03e8cf

SHA256
34a742397244bd2848291f7d1087eb43462a69272f22249e24c2aa71e79d14f3

SHA512
80f39a82a12899601da3dfc3092ba7465554b360a741fe26c0e4fbe3fac9b62ddde1f8c50f972eabf982427ac0b120edd67e8be31161a4ce4e2f8ef0dd53b26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF6B2.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF6B2.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF74F.tmp

Filesize
912KB

MD5
b15dbf4b35cd1460ba283795e24878c8

SHA1
327812be4bfdce7a87cb00fab432ecc0d8c38c1e

SHA256
0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147

SHA512
95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF74F.tmp

Filesize
912KB

MD5
b15dbf4b35cd1460ba283795e24878c8

SHA1
327812be4bfdce7a87cb00fab432ecc0d8c38c1e

SHA256
0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147

SHA512
95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF899.tmp

Filesize
782KB

MD5
175d9b039177b405ee04c81f4c9aa4af

SHA1
6b523f7652761f4a24cf12ce08a32479ed03e8cf

SHA256
34a742397244bd2848291f7d1087eb43462a69272f22249e24c2aa71e79d14f3

SHA512
80f39a82a12899601da3dfc3092ba7465554b360a741fe26c0e4fbe3fac9b62ddde1f8c50f972eabf982427ac0b120edd67e8be31161a4ce4e2f8ef0dd53b26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF899.tmp

Filesize
782KB

MD5
175d9b039177b405ee04c81f4c9aa4af

SHA1
6b523f7652761f4a24cf12ce08a32479ed03e8cf

SHA256
34a742397244bd2848291f7d1087eb43462a69272f22249e24c2aa71e79d14f3

SHA512
80f39a82a12899601da3dfc3092ba7465554b360a741fe26c0e4fbe3fac9b62ddde1f8c50f972eabf982427ac0b120edd67e8be31161a4ce4e2f8ef0dd53b26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF9A3.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIF9A3.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFA31.tmp

Filesize
196KB

MD5
efa1291d4eb0ff2050967dd63bfdbdc8

SHA1
54ba41d5a6fb192267b36127ff573cb112413fd8

SHA256
da78931d835e91c59cadaebc95fbae56020ce5031523a6a175fefa4582334ac4

SHA512
5fcce6422b0ee6827a57c5d0c476e36a5e75a880550b8041a0f3db42b630f483654508a797421ff4316fd84db549c8c78536a25d5da2de9eb60365720517d5e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIFA31.tmp

Filesize
196KB

MD5
efa1291d4eb0ff2050967dd63bfdbdc8

SHA1
54ba41d5a6fb192267b36127ff573cb112413fd8

SHA256
da78931d835e91c59cadaebc95fbae56020ce5031523a6a175fefa4582334ac4

SHA512
5fcce6422b0ee6827a57c5d0c476e36a5e75a880550b8041a0f3db42b630f483654508a797421ff4316fd84db549c8c78536a25d5da2de9eb60365720517d5e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Urban_TOS.html

Filesize
24KB

MD5
993c38c176078ec82cf3d5e21e24cdc0

SHA1
153b97b354ee42cce9dce40b9559577bf37ec303

SHA256
34a4cfe3fbf3172596a779b960b6f92702137ec2d005d144a5d5fd41b7d64221

SHA512
6e52a2be3d012411cb51148a13e554e3b87d3fb278f898e0bc510ba4c23172623c79857da66c2f10b8957e542674c1fd7a24d99bcde8b1e37031055060910e59

Download Submit
C:\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.8\install\FEC3FEE\urbanvpninstaller.x64.msi

Filesize
8.2MB

MD5
ab35290adfaf8786c0235faad19c3f88

SHA1
d595ad8a78d3220f062ff5b90b0724c2346bc1ce

SHA256
ea0f099451ecb46149d4474e0752acf1f84a034d09fee87d56b5a54884260156

SHA512
1aaa1a987672a7fcf9c7c8c0c2322ea59a47c126b3765188e87e99cc622acaa26c75f99ed6e2c8cf43db5150495dd8c126431fb34d8587f0dbd7539d220f7d04

Download Submit
C:\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.8\install\decoder.dll

Filesize
206KB

MD5
899944fb96ccc34cfbd2ccb9134367c5

SHA1
7c46aa3f84ba5da95ceff39cd49185672f963538

SHA256
780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259

SHA512
2c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0

Download Submit
C:\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.8\install\decoder.dll

Filesize
206KB

MD5
899944fb96ccc34cfbd2ccb9134367c5

SHA1
7c46aa3f84ba5da95ceff39cd49185672f963538

SHA256
780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259

SHA512
2c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0

Download Submit
C:\Users\Admin\AppData\Roaming\Urban Security\UrbanVPN 2.2.8\install\decoder.dll

Filesize
206KB

MD5
899944fb96ccc34cfbd2ccb9134367c5

SHA1
7c46aa3f84ba5da95ceff39cd49185672f963538

SHA256
780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259

SHA512
2c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0

Download Submit
C:\Windows\Installer\MSI190D.tmp

Filesize
782KB

MD5
175d9b039177b405ee04c81f4c9aa4af

SHA1
6b523f7652761f4a24cf12ce08a32479ed03e8cf

SHA256
34a742397244bd2848291f7d1087eb43462a69272f22249e24c2aa71e79d14f3

SHA512
80f39a82a12899601da3dfc3092ba7465554b360a741fe26c0e4fbe3fac9b62ddde1f8c50f972eabf982427ac0b120edd67e8be31161a4ce4e2f8ef0dd53b26a

Download Submit
C:\Windows\Installer\MSI2CA.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI2CA.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI3B5.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI3B5.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI4B0.tmp

Filesize
782KB

MD5
175d9b039177b405ee04c81f4c9aa4af

SHA1
6b523f7652761f4a24cf12ce08a32479ed03e8cf

SHA256
34a742397244bd2848291f7d1087eb43462a69272f22249e24c2aa71e79d14f3

SHA512
80f39a82a12899601da3dfc3092ba7465554b360a741fe26c0e4fbe3fac9b62ddde1f8c50f972eabf982427ac0b120edd67e8be31161a4ce4e2f8ef0dd53b26a

Download Submit
C:\Windows\Installer\MSI4B0.tmp

Filesize
782KB

MD5
175d9b039177b405ee04c81f4c9aa4af

SHA1
6b523f7652761f4a24cf12ce08a32479ed03e8cf

SHA256
34a742397244bd2848291f7d1087eb43462a69272f22249e24c2aa71e79d14f3

SHA512
80f39a82a12899601da3dfc3092ba7465554b360a741fe26c0e4fbe3fac9b62ddde1f8c50f972eabf982427ac0b120edd67e8be31161a4ce4e2f8ef0dd53b26a

Download Submit
C:\Windows\Installer\MSI54D.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
C:\Windows\Installer\MSI54D.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
C:\Windows\Installer\MSI5FA.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSI5FA.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSI947.tmp

Filesize
196KB

MD5
efa1291d4eb0ff2050967dd63bfdbdc8

SHA1
54ba41d5a6fb192267b36127ff573cb112413fd8

SHA256
da78931d835e91c59cadaebc95fbae56020ce5031523a6a175fefa4582334ac4

SHA512
5fcce6422b0ee6827a57c5d0c476e36a5e75a880550b8041a0f3db42b630f483654508a797421ff4316fd84db549c8c78536a25d5da2de9eb60365720517d5e6

Download Submit
C:\Windows\Installer\MSI947.tmp

Filesize
196KB

MD5
efa1291d4eb0ff2050967dd63bfdbdc8

SHA1
54ba41d5a6fb192267b36127ff573cb112413fd8

SHA256
da78931d835e91c59cadaebc95fbae56020ce5031523a6a175fefa4582334ac4

SHA512
5fcce6422b0ee6827a57c5d0c476e36a5e75a880550b8041a0f3db42b630f483654508a797421ff4316fd84db549c8c78536a25d5da2de9eb60365720517d5e6

Download Submit
C:\Windows\Installer\MSI977.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI977.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSI9E5.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSI9E5.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSIB00.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSIB00.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSIB3F.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSIB3F.tmp

Filesize
231KB

MD5
fd9c9125577e39e220c1e1b7c0206820

SHA1
67850a3ea6b672050f137e82cabfdcc4391a2423

SHA256
2877c6c075a9b7f67dcb335b0779385af7ec29895ba03455348c982a86ef04c1

SHA512
ba3a729b77a218f427ee7c185008e4482933b70e77bee1deff31c5ae16664e6da5f6a5fa1388888a3b96cf1d396380ecc92e3ca4cb227f7f1a5d5ed1e7022698

Download Submit
C:\Windows\Installer\MSIB7F.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSIB7F.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Windows\Installer\MSIBAE.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
C:\Windows\Installer\MSIBAE.tmp

Filesize
602KB

MD5
78b793e3f44b2c7849ffe70083c500c0

SHA1
9dcbb160c9f606bcdbee9ad572aaab1ad1b24d61

SHA256
fbcf7c3645d90621bfbbf38e660a510dd0731b02b6e7820b075116e944301174

SHA512
36d0fadd2a55231ce159519ca4bfb56fee038ee82bfbafa375faee17e11e2149ffffb4b364bc80e4ed950325e0c31e6a02244c591a0b983c7ccc039e94a3e9c8

Download Submit
memory/64-219-0x0000000000000000-mapping.dmp

Download
memory/512-221-0x0000000000000000-mapping.dmp

Download
memory/512-209-0x0000000000000000-mapping.dmp

Download
memory/1148-217-0x0000000000000000-mapping.dmp

Download
memory/1248-135-0x0000000000000000-mapping.dmp

Download
memory/1256-207-0x0000000000000000-mapping.dmp

Download
memory/1484-171-0x0000000000000000-mapping.dmp

Download
memory/1680-228-0x0000000000000000-mapping.dmp

Download
memory/1680-230-0x0000000000000000-mapping.dmp

Download
memory/1940-172-0x0000000000000000-mapping.dmp

Download
memory/1952-202-0x0000000000000000-mapping.dmp

Download
memory/2324-229-0x0000000000000000-mapping.dmp

Download
memory/2424-182-0x0000000000000000-mapping.dmp

Download
memory/2568-215-0x0000000000000000-mapping.dmp

Download
memory/2668-204-0x0000000000000000-mapping.dmp

Download
memory/2832-208-0x0000000000000000-mapping.dmp

Download
memory/2856-203-0x0000000000000000-mapping.dmp

Download
memory/3720-205-0x0000000000000000-mapping.dmp

Download
memory/3760-163-0x0000000000000000-mapping.dmp

Download
memory/3944-213-0x0000000000000000-mapping.dmp

Download
memory/4024-212-0x0000000000000000-mapping.dmp

Download
memory/4088-206-0x0000000000000000-mapping.dmp

Download
memory/4184-225-0x0000000000000000-mapping.dmp

Download
memory/4852-223-0x0000000000000000-mapping.dmp

Download
memory/4972-201-0x0000000000000000-mapping.dmp

Download
memory/5052-227-0x0000000000000000-mapping.dmp

Download
memory/5088-210-0x0000000000000000-mapping.dmp

Download