Analysis
- user interaction
yes - max time kernel
150s - max time network
151s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
01/07/2026, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
free-windows-vpn.html
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
36 signatures
150 seconds
General
- Target free-windows-vpn.html
- Size 294KB
- Sample260701-1cvbcagw21
- SHA256 bcaa4f48eb5403c316148326ca6584fc56ccadf8c10c18bf4908014939ab1d81
- MD5 e5325d1facf0cffbcc2bb6397186f3ff
- SHA1 770876c384f42484d9a5f8beb54157e5f3dd79d4
- SHA512 fedbcfb7ce49e998f5d7ed81a0462fcdf2d7fae205fca5c68ad68f3b28f933ef86ef5aa6790be99e402af59646973fe0893c578a79e492ef776b7800769fd23e
- SSDEEP 3072:eJemkMXx5/IbHDVD0D2RrL1q37FUbvKltduvwDLifnmPozrhkr:epJx5/IbHDVD0D2R/SUL9kr
- TLSH T13554B3F35A6C64BD82ABE681A224F208F29F5136CB0454D1B7FF6198E78075B27F150B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
flow pid Process 202 3624 msedge.exe 382 3624 msedge.exe 513 4880 MBSetup-3.3.exe - Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup-3.3.exe File created C:\Windows\SysWOW64\drivers\mbamtestfile.dat MBSetup-3.3.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion MBSetup-3.3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate MBSetup-3.3.exe - Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation VC_redist.x64.exe Key value queried \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation VC_redist.x64.exe Key value queried \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation MSI1B37.tmp Key value queried \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation Urban Vpn Updater.exe Key value queried \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation urban-vpn-app.exe Key value queried \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation Urban Vpn Updater.exe Key value queried \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000\Control Panel\International\Geo\Nation UrbanVPN.exe - Executes dropped EXE 21 IoCs
pid Process 4880 MBSetup-3.3.exe 2500 UrbanVPN.exe 4900 UrbanVPN.exe 6064 VC_redist.x64.exe 3428 VC_redist.x64.exe 1348 VC_redist.x64.exe 4468 VC_redist.x64.exe 4240 VC_redist.x64.exe 4848 VC_redist.x64.exe 1568 VC_redist.x64.exe 5200 UrbanVPN.exe 1780 MSI1B37.tmp 5208 Urban Vpn Updater.exe 4464 urban-vpn-service.exe 2192 Urban Vpn Updater.exe 3028 Urban Vpn Updater.exe 6500 urban-vpn-app.exe 6200 Urban Vpn Updater.exe 6380 urban-vpn-app.exe 6088 MBAMInstallerService.exe 6880 MBAMInstallerService.exe - Loads dropped DLL 64 IoCs
pid Process 2500 UrbanVPN.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 2500 UrbanVPN.exe 3428 VC_redist.x64.exe 2312 VC_redist.x64.exe 4848 VC_redist.x64.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 2840 MsiExec.exe 2840 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 2840 MsiExec.exe 2840 MsiExec.exe 2840 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 4920 MsiExec.exe 2840 MsiExec.exe 2840 MsiExec.exe 2592 MsiExec.exe 2592 MsiExec.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe 4464 urban-vpn-service.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{77169412-f642-45e7-b533-0c6f48de12f9} = "\"C:\\ProgramData\\Package Cache\\{77169412-f642-45e7-b533-0c6f48de12f9}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{77169412-f642-45e7-b533-0c6f48de12f9} = "\"C:\\ProgramData\\Package Cache\\{77169412-f642-45e7-b533-0c6f48de12f9}\\VC_redist.x64.exe\" /burn.runonce" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UrbanVPN = "\"C:\\Program Files\\UrbanVPN\\Urban Vpn Updater.exe\" /checknow -minuseractions -restartapp \"C:\\Program Files\\UrbanVPN\\bin\\urban-vpn-app.exe\" -restartappcmd \"--tray-minimized\"" msiexec.exe - Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 417 2840 MsiExec.exe 418 2840 MsiExec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: UrbanVPN.exe File opened (read-only) \??\Z: UrbanVPN.exe File opened (read-only) \??\I: UrbanVPN.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: UrbanVPN.exe File opened (read-only) \??\Y: UrbanVPN.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\K: UrbanVPN.exe File opened (read-only) \??\X: UrbanVPN.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: UrbanVPN.exe File opened (read-only) \??\J: UrbanVPN.exe File opened (read-only) \??\B: UrbanVPN.exe File opened (read-only) \??\R: UrbanVPN.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: UrbanVPN.exe File opened (read-only) \??\U: UrbanVPN.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\M: UrbanVPN.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Q: UrbanVPN.exe File opened (read-only) \??\S: UrbanVPN.exe File opened (read-only) \??\J: UrbanVPN.exe File opened (read-only) \??\O: UrbanVPN.exe File opened (read-only) \??\T: UrbanVPN.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\A: UrbanVPN.exe File opened (read-only) \??\S: UrbanVPN.exe File opened (read-only) \??\Z: UrbanVPN.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\L: UrbanVPN.exe File opened (read-only) \??\O: UrbanVPN.exe File opened (read-only) \??\V: UrbanVPN.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: UrbanVPN.exe File opened (read-only) \??\W: UrbanVPN.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\B: UrbanVPN.exe File opened (read-only) \??\D: UrbanVPN.exe File opened (read-only) \??\R: UrbanVPN.exe File opened (read-only) \??\N: UrbanVPN.exe File opened (read-only) \??\P: UrbanVPN.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\H: UrbanVPN.exe File opened (read-only) \??\U: UrbanVPN.exe File opened (read-only) \??\K: UrbanVPN.exe File opened (read-only) \??\Q: UrbanVPN.exe File opened (read-only) \??\N: UrbanVPN.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: UrbanVPN.exe File opened (read-only) \??\T: UrbanVPN.exe File opened (read-only) \??\V: UrbanVPN.exe File opened (read-only) \??\H: UrbanVPN.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\949D2E01833511C6366A8B529939FE66_E80B95907B62816351718DBAEA6F9F40 urban-vpn-service.exe File created C:\Windows\system32\vcamp140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140rus.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_FBB92E1BC7DB0AC6FD63F7ABB06B390C urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 urban-vpn-service.exe File opened for modification C:\Windows\system32\msvcp140_2.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140fra.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140enu.dll msiexec.exe File created C:\Windows\system32\msvcp140_atomic_wait.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfcm140.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959 urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\064D75DF60A1456F63CEF9F347BAA00B_E54FB72B2D8B865F329FB65A1441F61C urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959 urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 urban-vpn-service.exe File created C:\Windows\system32\concrt140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140u.dll msiexec.exe File created C:\Windows\system32\mfc140kor.dll msiexec.exe File created C:\Windows\system32\mfc140rus.dll msiexec.exe File created C:\Windows\system32\mfcm140u.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\949D2E01833511C6366A8B529939FE66_E80B95907B62816351718DBAEA6F9F40 urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 urban-vpn-service.exe File opened for modification C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\vccorlib140.dll msiexec.exe File created C:\Windows\system32\msvcp140_1.dll msiexec.exe File created C:\Windows\system32\vcruntime140.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140deu.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59D76868C250B3240414CE3EFBB12518_C52F6434370270B2A9D78C68114E1F64 urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Urban Cyber Security\UrbanVPN\service urban-vpn-service.exe File opened for modification C:\Windows\system32\mfc140jpn.dll msiexec.exe File created C:\Windows\system32\mfc140esn.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 urban-vpn-service.exe File opened for modification C:\Windows\system32\msvcp140.dll msiexec.exe File opened for modification C:\Windows\system32\msvcp140_1.dll msiexec.exe File opened for modification C:\Windows\system32\concrt140.dll msiexec.exe File created C:\Windows\system32\mfc140chs.dll msiexec.exe File created C:\Windows\system32\mfc140jpn.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_C52F6434370270B2A9D78C68114E1F64 urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA urban-vpn-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 urban-vpn-service.exe File created C:\Windows\system32\vcruntime140_1.dll msiexec.exe File opened for modification C:\Windows\system32\mfcm140.dll msiexec.exe File created C:\Windows\system32\mfc140.dll msiexec.exe File created C:\Windows\system32\mfc140u.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 urban-vpn-service.exe File opened for modification C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File created C:\Windows\system32\vcomp140.dll msiexec.exe File created C:\Windows\system32\vcruntime140_threads.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140.dll msiexec.exe File created C:\Windows\system32\mfc140ita.dll msiexec.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\064D75DF60A1456F63CEF9F347BAA00B_E54FB72B2D8B865F329FB65A1441F61C urban-vpn-service.exe File created C:\Windows\system32\msvcp140_codecvt_ids.dll msiexec.exe File opened for modification C:\Windows\system32\mfc140cht.dll msiexec.exe File opened for modification C:\Windows\system32\vcamp140.dll msiexec.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN MsiExec.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\UrbanVPN\translations\qt_nl.qm msiexec.exe File opened for modification C:\Program Files\UrbanVPN\Urban Vpn Updater.ini msiexec.exe File created C:\Program Files\UrbanVPN\bin\UrbanVpn_UiControls.dll msiexec.exe File created C:\Program Files\UrbanVPN\plugins\imageformats\qsvg.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Basic\qtquickcontrols2basicstyleplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\impl\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\qml\UrbanVpn\UiDialogPopups\UrbanVpn_UiDialogPopupsplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\bin\dxcompiler.dll msiexec.exe File created C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\source.md msiexec.exe File created C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\win11\ovpn-dco.cat msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6Core.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Fusion\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Fusion\qtquickcontrols2fusionstyleplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Universal\qtquickcontrols2universalstyleplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\translations\qt_sk.qm msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6Quick.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Imagine\impl\qtquickcontrols2imaginestyleimplplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\qtquickcontrols2plugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\NativeStyle\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\translations\qt_ja.qm msiexec.exe File created C:\Program Files\UrbanVPN\bin\d3dcompiler_47.dll msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6QuickControls2Imagine.dll msiexec.exe File created C:\Program Files\UrbanVPN\plugins\tls\qschannelbackend.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Windows\impl\qtquickcontrols2windowsstyleimplplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\NativeStyle\qtquickcontrols2nativestyleplugin.dll msiexec.exe File created C:\Program Files (x86)\mbamtestfile.dat MBSetup-3.3.exe File created C:\Program Files\UrbanVPN\bin\opengl32sw.dll msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6QuickControls2.dll msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6QuickControls2FluentWinUI3StyleImpl.dll msiexec.exe File created C:\Program Files\UrbanVPN\bin\wireguard-nt-0.10.1-amd64\wireguard.dll msiexec.exe File created C:\Program Files\UrbanVPN\plugins\imageformats\qtga.dll msiexec.exe File created C:\Program Files\UrbanVPN\plugins\imageformats\qtiff.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Material\impl\qtquickcontrols2materialstyleimplplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtCore\qtqmlcoreplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Templates\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Templates\qtquicktemplates2plugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\translations\qt_bg.qm msiexec.exe File created C:\Program Files\UrbanVPN\translations\qt_da.qm msiexec.exe File created C:\Program Files\UrbanVPN\translations\qt_de.qm msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Imagine\impl\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\win11\ovpn-dco.sys msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6QuickControls2UniversalStyleImpl.dll msiexec.exe File created C:\Program Files\UrbanVPN\plugins\qmltooling\qmldbg_preview.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Windows\qtquickcontrols2windowsstyleplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\UrbanVpn\UiControls\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\qml\UrbanVpn\UiControlsEarly\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\qml\UrbanVpn\UiControlsEarly\UrbanVpn_UiControlsEarlyplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\translations\qt_en.qm msiexec.exe File created C:\Program Files\UrbanVPN\translations\qt_lg.qm msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6Gui.dll msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6QuickControls2MaterialStyleImpl.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtCore\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\FluentWinUI3\impl\qtquickcontrols2fluentwinui3styleimplplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\FluentWinUI3\qtquickcontrols2fluentwinui3styleplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\UrbanVpn\UiDialogPopups\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6QuickTemplates2.dll msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6Network.dll msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6QmlWorkerScript.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQml\qmlplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Imagine\qmldir msiexec.exe File created C:\Program Files\UrbanVPN\qml\QtQuick\Window\quickwindowplugin.dll msiexec.exe File created C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\win11\ovpn-dco.inf msiexec.exe File created C:\Program Files\UrbanVPN\bin\Qt6QmlModels.dll msiexec.exe - Drops file in Windows directory 53 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI6D2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1A1B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2C7E.tmp msiexec.exe File created C:\Windows\Installer\{DD85AE10-FF9A-48FF-91E6-3C427CBCB962}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\{DD85AE10-FF9A-48FF-91E6-3C427CBCB962}\SystemFoldermsiexec.exe msiexec.exe File created C:\Windows\Installer\SourceHash{560D2DA4-096E-4868-B22A-DA6418FDE6FB} msiexec.exe File created C:\Windows\Installer\e59dc18.msi msiexec.exe File opened for modification C:\Windows\Installer\e59dc18.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI740.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI18CF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3086.tmp msiexec.exe File created C:\Windows\Installer\e59dbef.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIE546.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI141A.tmp msiexec.exe File created C:\Windows\Installer\e59dc1a.msi msiexec.exe File opened for modification C:\Windows\SystemTemp msedge.exe File opened for modification C:\Windows\Installer\MSI92.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI995.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAC0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI13FA.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{DD85AE10-FF9A-48FF-91E6-3C427CBCB962} msiexec.exe File opened for modification C:\Windows\Installer\MSI1AA9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI354A.tmp msiexec.exe File created C:\Windows\Installer\e59dc02.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIEDE3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4B9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI529.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI18E0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1B37.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI35E7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDE6F.tmp msiexec.exe File created C:\Windows\Installer\e59dc01.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI973.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9A5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAD0.tmp msiexec.exe File created C:\Windows\Installer\{DD85AE10-FF9A-48FF-91E6-3C427CBCB962}\urbanvpnapp.exe msiexec.exe File opened for modification C:\Windows\Installer\e59dc02.msi msiexec.exe File created C:\Windows\Installer\SourceHash{5904914B-9FC8-44C2-AE48-5C7F30A603EC} msiexec.exe File opened for modification C:\Windows\Installer\MSI5A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI984.tmp msiexec.exe File opened for modification C:\Windows\Installer\{DD85AE10-FF9A-48FF-91E6-3C427CBCB962}\urbanvpnapp.exe msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF249.tmp msiexec.exe File created C:\Windows\Installer\e59dc17.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI673.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI16BB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI198D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1A0B.tmp msiexec.exe File opened for modification C:\Windows\Installer\e59dbef.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI4F9.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Urban Vpn Updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Urban Vpn Updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UrbanVPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UrbanVPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Urban Vpn Updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Urban Vpn Updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UrbanVPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI1B37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MBSetup-3.3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VC_redist.x64.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3624 msedge.exe - Checks SCSI registry key(s) 3 TTPs 13 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc urban-vpn-app.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c0d09bdcdad7440f0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801c0d09bdc0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050dc000000ffffffff000000000700010000e84101c0d09bdc000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4de0000000000000005000000ffffffff000000000700010000486a6fc0d09bdc00000000000090d4de000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71c0d09bdc00000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 urban-vpn-app.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 urban-vpn-app.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 urban-vpn-app.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc urban-vpn-app.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc urban-vpn-app.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 urban-vpn-app.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc urban-vpn-app.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe - Modifies data under HKEY_USERS 23 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" urban-vpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" urban-vpn-service.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" urban-vpn-service.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" urban-vpn-service.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274150776905211" msedge.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections urban-vpn-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" urban-vpn-service.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" urban-vpn-service.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" urban-vpn-service.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" urban-vpn-service.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E urban-vpn-service.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\DeploymentFlags = "3" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\urban\ = "URL:Urban Protocol" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\urban\shell\open msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D15EE4AAF3E53D9488CC68E460CB755B msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents\{77169412-f642-45e7-b533-0c6f48de12f9} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B41940958CF92C44EA84C5F7036A30CE\Provider msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\urban\shell\open\command\ = "\"C:\\Program Files\\UrbanVPN\\bin\\urban-vpn-app.exe\" \"%1\"" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01EA58DDA9FFFF84196EC324C7CB9B26 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\Language = "1033" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\PackageCode = "EF1C5BBCEEFD25C458AFD3A70929F953" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{77169412-f642-45e7-b533-0c6f48de12f9} VC_redist.x64.exe Key created \REGISTRY\MACHINE\Software\Classes\urban\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\ProductName = "UrbanVPN" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Language = "1033" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\AdvertiseFlags = "388" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33816" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF\Provider msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\4AD2D065E69086842BA2AD4681DF6EBF msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents VC_redist.x64.exe Key created \REGISTRY\MACHINE\Software\Classes\urban msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\AuthorizedLUAApp = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\PackageName = "vc_runtimeAdditional_x64.msi" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14 VC_redist.x64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13} VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Urban Cyber Security\\UrbanVPN 5.2.1.8262\\install\\CBCB962\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33816" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33816" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{5904914B-9FC8-44C2-AE48-5C7F30A603EC}v14.40.33816\\packages\\vcRuntimeAdditional_amd64\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33816" VC_redist.x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 VC_redist.x64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Assignment = "1" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\B41940958CF92C44EA84C5F7036A30CE msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{560D2DA4-096E-4868-B22A-DA6418FDE6FB}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF\VC_Runtime_Minimum msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\Version = "237536280" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Version = "14.40.33816.0" VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\ = "{77169412-f642-45e7-b533-0c6f48de12f9}" VC_redist.x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\urban\DefaultIcon\ = "C:\\Program Files\\UrbanVPN\\bin\\urban-vpn-app.exe,1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle VC_redist.x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\urban\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\PackageCode = "91F98B658CFE3424B8A06B10C1A05637" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\AuthorizedLUAApp = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\urban\DefaultIcon msiexec.exe - Modifies system certificate store 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F UrbanVPN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 0f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba UrbanVPN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa42000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba UrbanVPN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A urban-vpn-service.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c0000000100000004000000800100000b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65 urban-vpn-service.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 6500 urban-vpn-app.exe 6380 urban-vpn-app.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4880 MBSetup-3.3.exe 4880 MBSetup-3.3.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 4356 MsiExec.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6500 urban-vpn-app.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 4652 msiexec.exe Token: SeCreateTokenPrivilege 2500 UrbanVPN.exe Token: SeAssignPrimaryTokenPrivilege 2500 UrbanVPN.exe Token: SeLockMemoryPrivilege 2500 UrbanVPN.exe Token: SeIncreaseQuotaPrivilege 2500 UrbanVPN.exe Token: SeMachineAccountPrivilege 2500 UrbanVPN.exe Token: SeTcbPrivilege 2500 UrbanVPN.exe Token: SeSecurityPrivilege 2500 UrbanVPN.exe Token: SeTakeOwnershipPrivilege 2500 UrbanVPN.exe Token: SeLoadDriverPrivilege 2500 UrbanVPN.exe Token: SeSystemProfilePrivilege 2500 UrbanVPN.exe Token: SeSystemtimePrivilege 2500 UrbanVPN.exe Token: SeProfSingleProcessPrivilege 2500 UrbanVPN.exe Token: SeIncBasePriorityPrivilege 2500 UrbanVPN.exe Token: SeCreatePagefilePrivilege 2500 UrbanVPN.exe Token: SeCreatePermanentPrivilege 2500 UrbanVPN.exe Token: SeBackupPrivilege 2500 UrbanVPN.exe Token: SeRestorePrivilege 2500 UrbanVPN.exe Token: SeShutdownPrivilege 2500 UrbanVPN.exe Token: SeDebugPrivilege 2500 UrbanVPN.exe Token: SeAuditPrivilege 2500 UrbanVPN.exe Token: SeSystemEnvironmentPrivilege 2500 UrbanVPN.exe Token: SeChangeNotifyPrivilege 2500 UrbanVPN.exe Token: SeRemoteShutdownPrivilege 2500 UrbanVPN.exe Token: SeUndockPrivilege 2500 UrbanVPN.exe Token: SeSyncAgentPrivilege 2500 UrbanVPN.exe Token: SeEnableDelegationPrivilege 2500 UrbanVPN.exe Token: SeManageVolumePrivilege 2500 UrbanVPN.exe Token: SeImpersonatePrivilege 2500 UrbanVPN.exe Token: SeCreateGlobalPrivilege 2500 UrbanVPN.exe Token: SeCreateTokenPrivilege 2500 UrbanVPN.exe Token: SeAssignPrimaryTokenPrivilege 2500 UrbanVPN.exe Token: SeLockMemoryPrivilege 2500 UrbanVPN.exe Token: SeIncreaseQuotaPrivilege 2500 UrbanVPN.exe Token: SeMachineAccountPrivilege 2500 UrbanVPN.exe Token: SeTcbPrivilege 2500 UrbanVPN.exe Token: SeSecurityPrivilege 2500 UrbanVPN.exe Token: SeTakeOwnershipPrivilege 2500 UrbanVPN.exe Token: SeLoadDriverPrivilege 2500 UrbanVPN.exe Token: SeSystemProfilePrivilege 2500 UrbanVPN.exe Token: SeSystemtimePrivilege 2500 UrbanVPN.exe Token: SeProfSingleProcessPrivilege 2500 UrbanVPN.exe Token: SeIncBasePriorityPrivilege 2500 UrbanVPN.exe Token: SeCreatePagefilePrivilege 2500 UrbanVPN.exe Token: SeCreatePermanentPrivilege 2500 UrbanVPN.exe Token: SeBackupPrivilege 2500 UrbanVPN.exe Token: SeRestorePrivilege 2500 UrbanVPN.exe Token: SeShutdownPrivilege 2500 UrbanVPN.exe Token: SeDebugPrivilege 2500 UrbanVPN.exe Token: SeAuditPrivilege 2500 UrbanVPN.exe Token: SeSystemEnvironmentPrivilege 2500 UrbanVPN.exe Token: SeChangeNotifyPrivilege 2500 UrbanVPN.exe Token: SeRemoteShutdownPrivilege 2500 UrbanVPN.exe Token: SeUndockPrivilege 2500 UrbanVPN.exe Token: SeSyncAgentPrivilege 2500 UrbanVPN.exe Token: SeEnableDelegationPrivilege 2500 UrbanVPN.exe Token: SeManageVolumePrivilege 2500 UrbanVPN.exe Token: SeImpersonatePrivilege 2500 UrbanVPN.exe Token: SeCreateGlobalPrivilege 2500 UrbanVPN.exe Token: SeCreateTokenPrivilege 2500 UrbanVPN.exe Token: SeAssignPrimaryTokenPrivilege 2500 UrbanVPN.exe Token: SeLockMemoryPrivilege 2500 UrbanVPN.exe Token: SeIncreaseQuotaPrivilege 2500 UrbanVPN.exe Token: SeMachineAccountPrivilege 2500 UrbanVPN.exe - Suspicious use of FindShellTrayWindow 59 IoCs
pid Process 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 4880 MBSetup-3.3.exe 2500 UrbanVPN.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe - Suspicious use of SendNotifyMessage 41 IoCs
pid Process 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 5936 msedge.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe 6500 urban-vpn-app.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4880 MBSetup-3.3.exe 2500 UrbanVPN.exe 2500 UrbanVPN.exe 6064 VC_redist.x64.exe 3428 VC_redist.x64.exe 1348 VC_redist.x64.exe 3488 VC_redist.x64.exe 2312 VC_redist.x64.exe 3300 VC_redist.x64.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5936 wrote to memory of 948 5936 msedge.exe 85 PID 5936 wrote to memory of 3624 5936 msedge.exe 86 PID 5936 wrote to memory of 1796 5936 msedge.exe 87 PID 5936 wrote to memory of 1796 5936 msedge.exe 87 PID 5936 wrote to memory of 1796 5936 msedge.exe 87 PID 5936 wrote to memory of 1936 5936 msedge.exe 88 PID 5936 wrote to memory of 1936 5936 msedge.exe 88 PID 5936 wrote to memory of 6020 5936 msedge.exe 89 PID 5936 wrote to memory of 3548 5936 msedge.exe 90 PID 5936 wrote to memory of 6020 5936 msedge.exe 89 PID 5936 wrote to memory of 6020 5936 msedge.exe 89 PID 5936 wrote to memory of 3548 5936 msedge.exe 90 PID 5936 wrote to memory of 3548 5936 msedge.exe 90 PID 5936 wrote to memory of 3664 5936 msedge.exe 94 PID 5936 wrote to memory of 3664 5936 msedge.exe 94 PID 5936 wrote to memory of 3664 5936 msedge.exe 94 PID 5936 wrote to memory of 5232 5936 msedge.exe 97 PID 5936 wrote to memory of 2124 5936 msedge.exe 98 PID 5936 wrote to memory of 5232 5936 msedge.exe 97 PID 5936 wrote to memory of 2124 5936 msedge.exe 98 PID 5936 wrote to memory of 3536 5936 msedge.exe 100 PID 5936 wrote to memory of 5084 5936 msedge.exe 99 PID 5936 wrote to memory of 3536 5936 msedge.exe 100 PID 5936 wrote to memory of 3536 5936 msedge.exe 100 PID 5936 wrote to memory of 5084 5936 msedge.exe 99 PID 5936 wrote to memory of 5628 5936 msedge.exe 102 PID 5936 wrote to memory of 5628 5936 msedge.exe 102 PID 5936 wrote to memory of 5628 5936 msedge.exe 102 PID 5936 wrote to memory of 6080 5936 msedge.exe 103 PID 5936 wrote to memory of 4848 5936 msedge.exe 106 PID 5936 wrote to memory of 3936 5936 msedge.exe 113 PID 5936 wrote to memory of 3936 5936 msedge.exe 113 PID 5936 wrote to memory of 5076 5936 msedge.exe 114 PID 5936 wrote to memory of 5076 5936 msedge.exe 114 PID 5936 wrote to memory of 5076 5936 msedge.exe 114 PID 5936 wrote to memory of 2640 5936 msedge.exe 115 PID 5936 wrote to memory of 2640 5936 msedge.exe 115 PID 5936 wrote to memory of 2640 5936 msedge.exe 115 PID 5936 wrote to memory of 4144 5936 msedge.exe 116 PID 5936 wrote to memory of 4144 5936 msedge.exe 116 PID 5936 wrote to memory of 4144 5936 msedge.exe 116 PID 5936 wrote to memory of 4356 5936 msedge.exe 129 PID 5936 wrote to memory of 1792 5936 msedge.exe 119 PID 5936 wrote to memory of 3708 5936 msedge.exe 120 PID 5936 wrote to memory of 5208 5936 msedge.exe 121 PID 5936 wrote to memory of 5208 5936 msedge.exe 121 PID 5936 wrote to memory of 5208 5936 msedge.exe 121 PID 5936 wrote to memory of 4936 5936 msedge.exe 122 PID 5936 wrote to memory of 4936 5936 msedge.exe 122 PID 5936 wrote to memory of 4936 5936 msedge.exe 122 PID 5936 wrote to memory of 2680 5936 msedge.exe 123 PID 5936 wrote to memory of 4308 5936 msedge.exe 124 PID 5936 wrote to memory of 4308 5936 msedge.exe 124 PID 5936 wrote to memory of 4880 5936 msedge.exe 125 PID 5936 wrote to memory of 2500 5936 msedge.exe 127 PID 4652 wrote to memory of 4356 4652 msiexec.exe 129 PID 5936 wrote to memory of 2092 5936 msedge.exe 130 PID 5936 wrote to memory of 2092 5936 msedge.exe 130 PID 4356 wrote to memory of 4900 4356 MsiExec.exe 131 PID 2500 wrote to memory of 6064 2500 UrbanVPN.exe 132 PID 6064 wrote to memory of 3428 6064 VC_redist.x64.exe 133 PID 3428 wrote to memory of 1348 3428 VC_redist.x64.exe 134 PID 4468 wrote to memory of 4240 4468 VC_redist.x64.exe 143 PID 4240 wrote to memory of 4848 4240 VC_redist.x64.exe 144 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\free-windows-vpn.html1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x2f8,0x7ffb70d4c188,0x7ffb70d4c194,0x7ffb70d4c1a02⤵PID:948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,561064854925759070,10911892336068894077,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,5529823033136694559,6358528489687833955,262144 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:22⤵PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,9397155072518033875,12965479751928021014,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:82⤵PID:1936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,8466383978578652315,2592072069802907878,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵PID:6020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10164532343451455345,4469316285200832880,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:12⤵PID:3548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,16503680140020160142,2915861210878667227,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:12⤵PID:3664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,6230876849664125956,18242404978709977001,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:82⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,7333153817777125827,12188267153897061272,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:82⤵PID:2124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,11108860813200753286,8410901154684289889,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:82⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5984,i,6021312891871721837,11180958755202626970,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:12⤵PID:3536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6832,i,3390364535064254929,2697649067022942490,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:12⤵PID:5628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7204,i,6369522742024551008,1045021697492873817,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:82⤵PID:6080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,7566078328945844217,18435627974668737670,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:82⤵PID:5148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,7566078328945844217,18435627974668737670,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:82⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,12979275153751308529,3869936744485719148,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:82⤵PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6696,i,7213929686428673578,13738564414199904246,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7552,i,11859310521060053160,7588258440401056025,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:12⤵PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7528,i,339322538050267069,6277001066209089693,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:12⤵PID:4144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7808,i,18406167891041707628,16523141882437066088,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:82⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,17491464266694209748,4848172994074230236,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:82⤵PID:1792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7812,i,9412003880469999311,12133270880700325069,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:82⤵PID:3708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6724,i,3047110336158884256,12485903672591864523,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:12⤵PID:5208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4860,i,16905011081495431295,16916628140412044418,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:12⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,1856332629121568286,10586048373908601864,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:82⤵PID:2680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,16127830952038650046,17172182865706664887,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:82⤵PID:4308
-
-
C:\Users\Admin\Downloads\MBSetup-3.3.exe"C:\Users\Admin\Downloads\MBSetup-3.3.exe"2⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4880
-
-
C:\Users\Admin\Downloads\UrbanVPN.exe"C:\Users\Admin\Downloads\UrbanVPN.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe"C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe" /q /norestart3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6064 -
C:\Windows\Temp\{7FDDA2C3-21DC-41D8-BF9E-FEA24A85DFF1}\.cr\VC_redist.x64.exe"C:\Windows\Temp\{7FDDA2C3-21DC-41D8-BF9E-FEA24A85DFF1}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=720 /q /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\Temp\{145C6174-96A3-49A0-ABCC-6C078C1312EB}\.be\VC_redist.x64.exe"C:\Windows\Temp\{145C6174-96A3-49A0-ABCC-6C078C1312EB}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{11E8B9A8-DA0E-443D-BCB7-C502B13063F4} {D18C9DBF-4BD2-45B5-8AD6-A0B1F4B452C3} 34285⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1348 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1132 -burn.embedded BurnPipe.{CD43C595-7234-444C-84B7-F17EBEC5C6BE} {E09C142E-7E1B-469B-B912-3F747A8176BD} 13486⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3488 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1132 -burn.embedded BurnPipe.{CD43C595-7234-444C-84B7-F17EBEC5C6BE} {E09C142E-7E1B-469B-B912-3F747A8176BD} 13487⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2312 -
C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{474CF6C8-ED6D-42E6-8B93-3F546233C4CD} {7A7E0461-95CC-4AE5-9A6B-3E14D96358BB} 23128⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3300
-
-
-
-
-
-
-
C:\Users\Admin\Downloads\UrbanVPN.exe"C:\Users\Admin\Downloads\UrbanVPN.exe" /i "C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN 5.2.1.8262\install\CBCB962\UrbanVPN.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\UrbanVPN" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UrbanVPN" SECONDSEQUENCE="1" CLIENTPROCESSID="2500" AI_MORE_CMD_LINE=13⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:5200
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8096,i,508127765028609176,3953277306395802157,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:82⤵PID:2092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5448,i,16471386524393682211,13354412232021081499,2097152 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:12⤵PID:1472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,6933294336115093351,2488824774782851258,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:82⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,6933294336115093351,2488824774782851258,524288 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:82⤵PID:2212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7176,i,8472331549775639265,15118874854098874936,262144 --field-trial-handle=3044,i,12003932766998479829,17128257445415282592,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:82⤵PID:6100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵PID:4692
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BE284AF10EE6B30ECC66D3654D87D0A2 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\Downloads\UrbanVPN.exe"C:\Users\Admin\Downloads\UrbanVPN.exe" /groupsextract:100; /out:"C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites" /callbackid:43563⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4900
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FADE32980AF9C980DCCE40E4D2C50AC92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4920
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding C67EF6672106096F99B9ED16A2A3FD512⤵
- Loads dropped DLL
- Badlisted process makes network request
- Checks for VirtualBox DLLs, possible anti-VM trick
PID:2840
-
-
C:\Windows\Installer\MSI1B37.tmp"C:\Windows\Installer\MSI1B37.tmp" https://www.urban-vpn.com/install-desk/2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.urban-vpn.com/install-desk/3⤵PID:1548
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.urban-vpn.com/install-desk/4⤵PID:4268
-
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1EE248A5544EECB8F8342B5C1EA98296 E Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2592
-
-
C:\Program Files\UrbanVPN\Urban Vpn Updater.exe"C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /configservice -name "UrbanVPN-Updater"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5208
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1156
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:21⤵PID:2688
-
C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /burn.runonce1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260701223203.log"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260701223203.log"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4848 -
C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe"C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{8E028602-9971-4DA2-8337-FCEF610DF693} {A66AD92B-747A-4052-AD02-CEDAD240D192} 48484⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1568
-
-
-
-
C:\Program Files\UrbanVPN\bin\urban-vpn-service.exe"C:\Program Files\UrbanVPN\bin\urban-vpn-service.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:4464
-
C:\Program Files\UrbanVPN\Urban Vpn Updater.exe"C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /runservice1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3028
-
C:\Program Files\UrbanVPN\Urban Vpn Updater.exe"C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /checknow -minuseractions -restartapp "C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe" -restartappcmd "--tray-minimized"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2192 -
C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe"C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe" --tray-minimized2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6500
-
-
C:\Program Files\UrbanVPN\Urban Vpn Updater.exe"C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /checknow -minuseractions -restartapp "C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6200 -
C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe"C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: AddClipboardFormatListener
PID:6380
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Executes dropped EXE
PID:6088
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Executes dropped EXE
PID:6880
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59dbf4.rbs
- Size 19KB
- SHA256 79664edfcb5bff9ff1d6d945d34665797dba5205ed2d9fdeac239f96c597eb78
- MD5 af029f140c80e3a1067bb2bede96045f
- SHA1 1aa2aae77f39a57f6744457d8e52dc6437daeaf2
- SHA512 ae1d3806b370f79713e77bb8241503492044b1ba4fb9ffb2021bf8ed7670f0893bedfcc4dd7c5e72eb233494463e41578980b4b395da30c5f76c54fa106ff2f9
- SSDEEP 192:zDRv1kR815dXcFUADIc1L+W+y4+agPuUb7:zDRv6R8TeC81L/cwb7
- TLSH T13092FC426680C9D3E8766B30CD675BA53B76DBD5A350438B50DC90308F93BCA2F9D68D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59dc00.rbs
- Size 19KB
- SHA256 7fb79e73170fb147ef727a693d8a32d753e18590e3ffb8e5a799e73947362e4b
- MD5 826015731bba0206ef048e0976ab1dc0
- SHA1 743d9ad15f887d0a4cc4c6fea388a2a1fe8216b3
- SHA512 319c90e964d515907affc9cd5fb03754dcafdd8f428de6b8ff36b17e560e96210bf352194b54e52995d560e84f39accd5614a438ef07e1cc9db1e900122c0008
- SSDEEP 192:zcXDiX1XMcXMEXMdXMHXMNXM6XM+YXMXXMJXMyXMnXMMXMPXM7XMhXcXlX2YXV6M:zSXv28mpaMSxcHUQxEeReDL
- TLSH T13192FC02AA40C6D3D8A62F30DD572F2A3775D3EA9760935B01DDD1348F837C66E8D68A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59dc07.rbs
- Size 21KB
- SHA256 2a0c674eec1122ff112d4474770e45a74de08025de19ace0e69fee7259b6d362
- MD5 772baa2b140599f47c165fa3914f93f7
- SHA1 94f54256a7daa97711adabd41f7a8944e337d6f3
- SHA512 8c631f4e8b4d1f514e98952148af6d3fc1e0aac471d676e324bae4dc3117a76cdd8782477b9dca3a8031746746fbb0c0b6798965c188582ece74edc6aeefbfb1
- SSDEEP 384:KkRBGR1nAKxNAUhUC7xJjrMNYPVIbS/gmoPuG9CLcdzkP:KYAJAKhCsf
- TLSH T191A20E03768099E3C8662BB1DD671BA93F72D7D99350434B10ACD1388F633C72E5AA9D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59dc16.rbs
- Size 21KB
- SHA256 2ef80fb26b71e54581d5bb75050236796caee742a09c755d1d4d74d189373288
- MD5 b93392e7ac1a806a4b2366b5bd8c1a12
- SHA1 7755571f04810d1c7f701dcadf06c90666a57f72
- SHA512 4c1ba65b9d276521b6afce04aa3e8244219ef2e1f1b62c0d2387adbd853c59b8518a62248d72f97ca69ddf6b32c892ee5b8ebd85e1f56d35a82ca7be57cce06e
- SSDEEP 384:NNrQoNFcB1np12gju4aD9WsalckU72eC6ob/HTqTJof4Nn5:NNrQoNFcB1np12gSLD9Ib/WFofUn5
- TLSH T1C5A20001AA44D593D8A62B70CD9747A537B6D3D9D7A1838B12CDC2304F933C71FAEA4A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59dc19.rbs
- Size 383KB
- SHA256 6c57a6a61b7755001f08ac6d94493a9db4a379758136b7fbbe087b68afaf828c
- MD5 b4b8e9155549c3c45d474b140e6bc9fc
- SHA1 4a55c93e08bdbf2f9bfa27261c24c51823855b65
- SHA512 f20caa15a04697f92a60e12785b77cb921f1e2d048d8cb89768a38d92042b11ce20479a8d290a6210483ac3b5ff4886770b4a09ff36a43059369678c3568112c
- SSDEEP 6144:msbvBbhOr4+T1lqK0rklph0lhSMXlBXBW/+BOmrm:msbhwtl6klph0lhSMXle+Er
- TLSH T14484BF10D911C0B2E22F2A70A765EECF5F2D9E508B5095DF73DC8D368CB1AC21B3965A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
- Size 1.8MB
- SHA256 462fd57639aa8f45c938df603bf94717a1c81e3c4356f515201618b789d52c12
- MD5 cd920f0a49d0cab5433c88da9f0f7d9d
- SHA1 8ab405b231e25495da978dc107df78fe1ef4526f
- SHA512 51bd2180cf3d0c6d85bc9ee5d2c55f8f2546cfbc33cb1ac0490e3be5b331f454b445229caa39bfc6f72b716ebbd8516587ab8daaecb6856ad14f10dee86952e7
- SSDEEP 49152:tJ1O7EpfelenkVglN5suzIEUP7ZmQNRB6XG+ChS9GBaaaa8arab7aa7aacPcvGqG:tSVqkVglN5yh+mpaaaa8arab7aa7aacj
- TLSH T1E9857E71369BC43BC47E40B06539FDAF953E6D269F5898C3A3C87D2D1A744C21632B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\UrbanVPN\Urban Vpn Updater.ini
- Size 199B
- SHA256 8e02a74eb01112b20a61276436253e77277faf2c322f88f8c67fc0f283b698d6
- MD5 01437f63b2af22383640e7acb3982261
- SHA1 cd9191e4fbd09b729db97a2fc510a8061c81787a
- SHA512 7b2dc2ed6e7bd2490f73f93c430e7086db559cfb6424f113fa6ce4d068aae3e050838fb834865f747da1d96afa5b875df836711eb85709c995bd9451fac1437a
- TLSH T11AD0C0C29C9C89DA820372D2531840F00393430C4F6100249184762EF701D1903AF3F8
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_70e1b232759411f18746daa0e249fd4a\7z.dll
- Size 1.6MB
- SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
- MD5 3430e2544637cebf8ba1f509ed5a27b1
- SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
- SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
- SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
- TLSH T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\UrbanVPN\updates\updatesNR.aiu
- Size 2KB
- SHA256 2afcb6bf962f1cad2aead8466200f8e9d52963de828d4496766094d7a0f1f9c7
- MD5 b9b828a894c5b31e32717e006192a955
- SHA1 f5dcad1e2a6f879d3400dd2bf3305d670472cb85
- SHA512 16296c3c8d12ae09d7aa983d1e1c56dc72465e0b38520f8c78ac117adda80f8a0b52d1d8f96b52e82e762e4cfd34acec8bc97a8f0875d42e891028aa0e1b4d2b
- TLSH T1245131D7E20157DE8A5B27D943191282AFBF62BC7B4448845123C1243301D6AE7EE7FA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\632040a71cb8de62c9f15f5a\5.2.1.8262\tracking.ini
- Size 69B
- SHA256 c67048cbe20578b54d2b47ab0649363ea3c48d709615e31f43493115fd693078
- MD5 389068738a1d97c73ef355d93e4cdff6
- SHA1 c88559f91798c1f8080eeb8a2cfd8b717e0a704b
- SHA512 5fb580290c762690a191bdeb1167dd8c4e79eddedfe58ed576f2d91ece8ba57984a9aae24a991986c9b20914ea475ad7c738a8e00bd343c55f7f2cf6642ce278
- TLSH T15FA0021D3C55227C9C47C90D945782641B7275403AF9502957FEC7C6E39CAF1CF59819
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\632040a71cb8de62c9f15f5a\5.2.1.8262\{C11FA8F0-0600-41E1-9108-9F36D45A1375}.session
- Size 13KB
- SHA256 1f06943bab59a235b28eb4e8f07b75a7e8c962a9613284bc34d2a4eaadc55d38
- MD5 6fda9a7299fe8fcdb67efcd9c04e78fe
- SHA1 e22b04303036b237095bd5e30866c5ef5c239176
- SHA512 e84d9b5ba5294424d6adc78e9b9135761669445420db846369d1671811564fdbef54e0d2ac6dd763e1e5d637807d2ea3ca9541566ddc51909d9f66999d125917
- SSDEEP 384:RIqa0qaXqaNqabYqaIqa0fqaiqawqa2qaRqaJqabWqa1gqaGeqaVqa3OqaSqayq9:RIs/VzYQCqoeZBDWNgeet/OKqBG
- TLSH T18352EC1A76FC5115E2B6A244EFE69432A737785A6C3C4E2E51C6434D63D2C027482FBF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
- MD5 f6eb566f9aba7efdbfb5c795bd65c547
- SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
- SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
- TLSH T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
- MD5 1a34bb39930694ea7604881fe671a327
- SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
- SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
- TLSH T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 d42f4c8192f111564827cc023c57594a22d455b51b4b0262c47c64fb0e970660
- MD5 381ca8682c04ac25a1e7d194c0db6c33
- SHA1 97e2642f0848945434b2aa7b80d666c3b108858e
- SHA512 4d1458d8dc4a6aa543964be8d314b0c064520b93ef8a6d8d328d1de033c6d50c54af05851d48f1c6526069deb4fb117dda0e9e7196499ac44e31d4af64d1aa07
- TLSH T193E0E5A6CC61AC3718FC0B1860A40B85E71013572B40464A363C5208CFB4A3762869AC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
- Size 86KB
- SHA256 daf261ebcfd84689ff547833992451eec82882e6daebcae9acd9f829834371e6
- MD5 bfb7e275c75e3a683d1fca0b6153eb6d
- SHA1 a37931ac7da98b6f8addc5ad68cd5187aa77e62a
- SHA512 52cd01c0de4b0f8cb4d7935765996f3bc53a0882d6686254c509c205d92fe4cb257214909c5b053ab05b00aebbd20b1ca779e800d8b112c7bbe397320e2d32bc
- SSDEEP 1536:uHHPX3yPkjEtwnE87aaPnGw7PWlUX4hwXzC435FVxb2UsAW3DadUH:uKPc7vvGwTGUX4OXzvqUszEUH
- TLSH T1CA831264279E99B4FCA6C3B0C088F0CA6F3A8612C497DF6ED8CAC025894F95C345F11B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
- Size 98KB
- SHA256 a70945a3f3e36f2a1d2c339403ed4b84eb3f9dca52bb6c7a64848f87d1ba806f
- MD5 c63f3846b9235d0252cbfeb8b47ea3b6
- SHA1 f16b144933c9cfaf58778a5898291df5ab0f985c
- SHA512 7a0a1532f6253b307808ab06fc49f6fc6c8dc540e924fca3b88677b3bbaf707b51ad174367df073dddbe447f88b0094778af7c5f858bfa379f31d9c76526a468
- SSDEEP 1536:5mTGprD11HFcs6IdI9zL8Hwfqzej0juW32R6ZLEiZTU/PJ1+Okx6:jrXFcId0HtfTgjuncZQpV7
- TLSH T11BA302C4144153231B1BBCD1BEEE05EA07E89ADEBB5F48A80E045F7C07767A2A5F1897
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
- Size 124KB
- SHA256 c1be53f49298d480430f529b421e38fbd3696afc72632501ef6095522a333fec
- MD5 f3f724a4c7f89a17c9eae1c9450ceb31
- SHA1 e64b061a82f1cb14c136b05b54110e55a4406506
- SHA512 61d48bfdd17c35489e10d7eafd71cffbf79bff8877de81fd1ad927f418812179351258852b70ec001419eba8639087d86e59960d24be023c930f3dd2d156a888
- SSDEEP 3072:9BqLLWPxuLmL0Ijhrqdp7CMo+0DbHijVq93mRNm3Z:GLtqL0IjVqdn6DWVq9U43Z
- TLSH T1BCC3122B4E941A20B0DF28134F54E754F7FE3D7B8A91464EA38B681D8E4D900D8E5AE0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
- Size 172KB
- SHA256 b156cb0d08225523324b9f0ba9a7847fdbf168eb1065604ef3dca54b0cc5131a
- MD5 4d1f27a47516de8a51cd83bfd0f2c6b1
- SHA1 f76982ed5b119dff72fafdd8e1f6fe4dc77d8fc2
- SHA512 383df5654793e8e33dff06c2d413e83323a4c565366b68f27052b00b091cd945a84ea75d63ca09389ded71f38b0139e62752a57a24994a363402645eafc7782c
- SSDEEP 3072:IeOe9vaKTo2j3rFkWiaXXghXJfTmkGik4P5T9DyzvsppVA9hNwlJG/CZZ1ICxaJ:I69vab2j72HfTX11IvOQGw/nN
- TLSH T1FE04235C8F2BBAB01E078872CD712215CFB72A1285117AA917A71E4E871FCBDF5D46B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
- Size 141KB
- SHA256 4bff5392ceb18fbf2aaa8b8af8cb14264cf42da86678cee579eb281a6ceb645f
- MD5 4514b79060d6f04f0a5949e438e2d878
- SHA1 6c479142d3520cb603284a594e1660cf8ee181ec
- SHA512 f2192d2eaf010cd8e3054396ff01512496723b46607becdd0d352d1636694f1e1ab9ba017dec616fe3f08974bb92f0b3005c175fb63fe9c8a9f6e8102ecc384e
- SSDEEP 3072:cuSAoXRndYgO46Hn8G5K537Ojh4akJEouWt26rp9HS:cu4dq46HOOoJEWHy
- TLSH T13AE3121B9FC65D7D0A7A85FDA2D8814ED0A2F1F0ACE79908E4C4C89B4B621D6C4FC439
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
- Size 56KB
- SHA256 573095ed4c32437824a3cb0f57da9528454d3b13efb0109361ec4afff66d10da
- MD5 c8467f43cbb7c8136cb1be54088c257d
- SHA1 abda2f20237b23538a4094132ecc3cefb01786af
- SHA512 560e37221b9b47a08caa319a35fc0d22b7ad42386913f7141f9e1fcbb0a1f09076e6aad30f2adfeccd3aec6792c8274858922f94df7b246e3777a211658f6841
- SSDEEP 1536:CaJGbMPpoU8+XtG+UnrFn8q3vH/8fA48yWR+GbM:qbMPpoU8+XD4rF8SfyCfM
- TLSH T18F430270004951EE4FFF99069E924DA43C80035D54283BC0E17FE6D3A3F9AFE9A86B58
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011a
- Size 72KB
- SHA256 f3a98322f5ffe5072997b322be05ace1fcbcf55cd4cfa5a8f9561cf31bd73cf3
- MD5 cde24863f03b7e0bd9d055d53470a9a0
- SHA1 45e0546bf5e181b737e1d0b4d380e786fb8cdbd8
- SHA512 8b506ef42ca8577e16d413f133b094cf89916660b290dadd3ec6801a17b1946245bb09a94e884ac04455083428efee2cc7d2800de411e669d0c8653c15f85207
- SSDEEP 1536:ZwiXly6nnxVfatRrCOp2zGjAY+oINDgy9BqEJN8wbodbvCKMDQKcdtWLM:ZXXly6nbatRr3p2akYZaTH8Z4svt2M
- TLSH T1477312B42F149DA1CD8DC9C62B7CD8E9C2281565EA43E212C23764E3DA5B1CCF0B9C02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011d
- Size 97KB
- SHA256 4537e080b3d81914b8f5879a0844eddbba94a6bb53c964872a7f09d82ec7f933
- MD5 5876f75bc145847a62287624d13b6db2
- SHA1 5e8d5572b4e566f6a43f57f241d345c106f3b7bc
- SHA512 abd99ce100d7b5ea891dc58992829d6c8f3d9e4005aee0a7da00d367367ab52a2feda338834d01a0908a2f87954d2fe8b98c8c0b01d1e3acbc45e0ffb5ca35b8
- SSDEEP 3072:TZV7/kEWHGrc0MVkJ20qQj+oQ3jkPjfPu2hm82v8s4:fktGG0N4qjO2hm82kB
- TLSH T114A302D417D78B7AFAAA4474D22ADBF3460ED749D334DE60F404B198202AADDAC481FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 9KB
- SHA256 6adf44ed2e67b1561929b4bd99b7cfdcd31412e04529d1ed9a6d9dff31be57e2
- MD5 fe3502df58fd167e106b7f6bd2e0e67c
- SHA1 ab3a5298033675e330670c39aeb96de6f21d1c81
- SHA512 0b8418d9e7b4f697ca1227b787779f7ca186ba6660a765e9359b0e8d89c1f25a172b96d9dce36f7bacc7ac97a1502e668aa6a0c4bd463afd85dc9b1f6ad59b08
- SSDEEP 192:7b0Ckz2+YW3LrbLwd2QxcySJyl25XC3BxjOv:XCbfP62WOnv
- TLSH T1A1220B342AD115B4DFA61038A4EA5E0532B698D7F11F7FB65184013C2ADB6E3F0EA237
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 10KB
- SHA256 18362391da5e79bd0f5a56e461cec906c06fb7b0d6fd67996df2e731f8d40259
- MD5 4e87c9ecb894adfef7ac47416141d559
- SHA1 789106982f7dbc59476620e98a27d97ba35fcd72
- SHA512 6cf3c184d688caa0e50780f127ad710d4e4b7de632f357a01cd18e848f96252bbe5b9ef5e2127f6abfbcd87460d8cec1ab7ecbbc81de248cca2220f022e9c6d4
- SSDEEP 192:Uqrl5Z26z513LobLwg2QxcEC7drnl25CIOMxjOJ:vd/8P72wYr7J
- TLSH T109220C342BE215F4DFA61438A0EA5E05327698D7F15F7FB6118401382ACB7E7E49A237
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59aa8e.TMP
- Size 3KB
- SHA256 4aa424ef3649f15e6eca111cacac70c9f8821e75c7b64c7746d030a9d3ea4dd4
- MD5 e1ccaecb0e0723288bdff0dd5fd407f6
- SHA1 7310d8b29d555b7218c67eb529270f2bc28d19c1
- SHA512 a90ba79a052ed75ef3c978e3c80f18e694f180f1d096bde0e496861c1247a4b55c4747da2fc3540b724d677d1bac16bfe803f810d24c5de050b49f59b2d14c25
- TLSH T1FA71E7340B6200B4DBA32639D1DF86563AB2C4D6F81B7FE8555C4A30872EB71F4E7229
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
- Size 106KB
- SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
- MD5 25dca813dd764f2197142ef84bc5ce66
- SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
- SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
- SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
- TLSH T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.urban-vpn.com_0.indexeddb.leveldb\MANIFEST-000001
- Size 23B
- SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- MD5 3fd11ff447c1ee23538dc4d9724427a3
- SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
- SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 22KB
- SHA256 2ba3db25055fa7b80c5bffdf767c777fc935d109e35af7b0194d74e82ac1e417
- MD5 b03cedf395f9cea6d04503610c99b962
- SHA1 fb509abf4c9e2c4aed7552fe7c60fccf02457a7b
- SHA512 84dcc95857b3d4193feb0edba26b89861fa9c08ccf4c335fc1a87399391a0cc90a75c8f70a5bdbd02f45309076e53222931f36d442ee4eac13d53ef4633e775c
- SSDEEP 384:D1JcSlNyeIHXa/g6emqeHdbGeitUWzOX7nQJw+Zxg/RC0/aaiGYuJBhZOz4fR7e5:PPF57rxieu
- TLSH T16EA2AEF7C3E5862DD81255F0AB147E2BCE1D095943283C6A88E5BF5BA3F2471E10169F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
- Size 40B
- SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
- MD5 20d4b8fa017a12a108c87f540836e250
- SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
- SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 14KB
- SHA256 b23538dc4d030286550a65e3c7d671deb96b8951d710a1183874950b64f8522e
- MD5 1a38427f6c4f18b06daa29f9c588af0c
- SHA1 b1710d56f7014d5c9344d03696c938001b0921f0
- SHA512 3d97da38ee4398604ee164f861a2606855ca94abd09b37a9fbabbe5dcb87d4204343d67cf17cc456f3b81da115ee0b790294d6d2d0da4c2e71144e0523325ee1
- SSDEEP 192:sxZzR6yMqZjK1Ml8MWPz/fzs2ynP8Z5z/ftodpHD9HW6+WNGYQuxcevIgjCJ:sxZzzuPz/fzs20C5r6RHbGkcOje
- TLSH T13C62D7166B34597B8CDBD20DFA55BF53D6F9552392904E449AFCCA0C01E7AEC221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 17KB
- SHA256 e7bf04556a889280b4c887142be5895c4c04ded3640ecd621cfbcea8877f0957
- MD5 e1b56f28b53cce424b34c98e357b1ebb
- SHA1 2fedcae089bf8f3c0bfd99682d3d26cfd4aefd56
- SHA512 445835c9c2f55338b70883f1b2635ff3f85e96ef780d7cd9fab38870a99bf0982b07a0a2b7bd20c8628ed089c3286004966d08ea6545a94594471c87616abdd7
- SSDEEP 192:sxZuQUnoR6yMqZjK1Ml8MWPz/fzs0ynP8Z5z/f7bCYRodp4xD9HW6+WNB+M/YQ/W:sxZwnozuPz/fzs00C5ryHQHb7/ucOie
- TLSH T18882F7066A24597B9CD7D219FA06BF63E6F90163D6844E44A6FCCA0C00F7ADD221382F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 20KB
- SHA256 e47b4e4df14ec4ded9cda784b18a1bc1155ee52b49212158bcdb65557a678e2b
- MD5 6d49561bab0f24b6878cb303a7283346
- SHA1 4106d9c70cb23f6d0032257055c38e069d558229
- SHA512 0806cb589378438b8736b0fbd8e0ea512e7c721aba4aaa56421454bc5a1a865fc7598c5e74e5218ea52d7931af7d000ae5d788371089d6e0d3b5e081cd7a2c3c
- SSDEEP 384:sxZwnfzsm4z/fzs0fC5roXpHbRM/ecOim26:sSfQm4z/f3fqCHb4ec76
- TLSH T1049208126A2499B7CCD7D519FA31BF53E7F90163DA444E489AFCCA0C04EB6ED221381B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 ddd93c640e662c502f8eb86638cc1df77a2298622f6e99b3321005e81ad97b67
- MD5 05935d2041921213c2915352f66cfcb9
- SHA1 da1777fe0ccc73476b61fb62b7ddeaded5a5d048
- SHA512 12857425d3c7e0616dd87b28b12e481e52fac401d62cf2d444b3a35b85e2bfac067ef4244c51b9b84be70447d5a8135ce2be134629431716442650f79874268c
- SSDEEP 768:cFADqXGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfRLl5bKp7roK/X:cFADqXGWviq5iu1jaSRLDmpIK/X
- TLSH T16DD20B2F684CCB7E4F841E5CEC266F8B6DD802CB6A984D5447EA844C02C77EE512B5DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\63490acf-4c3c-410d-8090-7dbd5a881653\index-dir\the-real-index
- Size 72B
- SHA256 200510cfa7ba2064b580cf386b20f257a52903655d40c4cb057a42f09202465d
- MD5 a5fe709e1c13fec2481822827dccbc35
- SHA1 202ac6f4ae4596ae26db78d993a810f4fa8bfc8c
- SHA512 c08a78cf72057315a1185be2695441e05f4940e602fb3c32eb3f0fbbcee0cb2584c09bae74449f50c79761a7f3978c7246395b8ae257272372a16714bbbb204f
- TLSH T192A002608B901005D01211F1759367431320C8903300270751F10198CD504948D5200C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\63490acf-4c3c-410d-8090-7dbd5a881653\index-dir\the-real-index
- Size 72B
- SHA256 4d08566045a8fff3f8ad8d89d36b63dcf61925eb252fcb1c0f3172fccfdcd0f1
- MD5 32bb6d2d06bd239018aba746087e0427
- SHA1 8faa4782e1626e4f5c2de48f66240b81197b2a1f
- SHA512 841512fc6c75885ff842d61e98370a20bd096aed587d163a4431e3e5ffaffd82d23a8d33df386f2f36c81950a695d3afc83a10f02b87cfcc9d3792b6b9d9f922
- TLSH T104A0025806C07026D12F13B265D61661676069D01315A3A98298544CC8D078A45C101C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\68b528cb-fe7f-46e0-b568-05fcf4e883af\index-dir\the-real-index
- Size 2KB
- SHA256 17837a159cf08c239c4f8ef5df7e9113dd7aa710ff3994f0f46c0760993b5063
- MD5 df7e4ed58f281161aeddfd123422fe44
- SHA1 19bc919ca59358326d77aa2f6e8a48f4a6f71a52
- SHA512 de493ede9c432f749782f6d057a504a922097d8f636b08e586a89ef85a31f29c047eb1937ec4fe65ae9576ed75239fad2c404cb8ec80949e64b5fb8cbd1ff845
- TLSH T106410A4D0D508A6FDC6841B308B2A4D433F0A8CD5B199713ACBC2230BE4376D291B6FC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\68b528cb-fe7f-46e0-b568-05fcf4e883af\index-dir\the-real-index
- Size 3KB
- SHA256 fc72fa2757f6a802cd68eea26fab25fa38af6bd52ae489c9e043f483f83fa413
- MD5 f170f50a7427b6c8ac249f2553ac6230
- SHA1 65c83f042f02843319b362556335b4d4ee62e2f8
- SHA512 332120f5010d9d9862ee94b493fe1f0cf34d0eac8d174e9c53a68c35a9c6ab18bd6f8f2553545404b0c3c16ffecd5611e8093e0256048b1e3bcd9e803f00752a
- TLSH T1F351E90E4D4A694ACD68127268FE14C523B96CCD6A488F0B26FD2134BCC3A3C1955269
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\68b528cb-fe7f-46e0-b568-05fcf4e883af\index-dir\the-real-index~RFe58d750.TMP
- Size 2KB
- SHA256 43eff1aab7d5c812e004414698460f605ed7eb4c0d62abc589fc41b97cd1ae56
- MD5 59d439c15be1ca12c3ed357b566df461
- SHA1 a20b3f5d872ca29c075e54ac7fc9dce5b4c0190a
- SHA512 a65ad831053b5414a93206d1fdf48bcd2381e63c33d2efb9258c9a6445f486079bb9a46e3bca6329bce62f858acd278fbe703a15a58b174509ea993bbe920caa
- TLSH T1E241CC594E818A2EE85440770DE3B4F47336584087157F4778BC9235A9927AD2D5A0E9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 371B
- SHA256 1b56a3aa611f88787fba81e6929720f122dded77f7a435461adea08a145ac1f3
- MD5 28708e92f0f7cb8a21516b717fe03c34
- SHA1 660f4c408e1b8ab7c48e32f5b783c03801544d88
- SHA512 65169ad880446c87c81b19ead8e9b930ea3aea84beb64c21a68ba74ad63d7af51a8aa9c9b703713a3fcefd8a25c88e4b27ee9862e0ed36aff187cb8cb51bd31f
- TLSH T1B0E068BA3DE32824EC1F87EA2431686801103845C998ED4F103B5383907125228AAC62
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 72B
- SHA256 7ee261c438db16b92cdbb74ef18bd9c4a2c3cc56a99b446693eee7861f671967
- MD5 28836fe1422297d7146a3f66473202d0
- SHA1 6c8ff5196861ebeceaf31d4dac8c09f02c1fdee7
- SHA512 8ad0fc98b375b1b31294c67aecdf458d6d80f94bd6e2f4394618e85359fb8e594dab7018393dc6e7feb8bd5060302808cc31d580ebce94651f21a950a6f7f039
- TLSH T189A002B0864F1C11F90D467970596280B399CC55022597034E90D0A9ACE71C09645791
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592fc1.TMP
- Size 48B
- SHA256 e54367ad3848434241c4e867d1abfd72795ba98927ccdce31fe0747647c7035c
- MD5 e6a2814cf6267316f073d7837ad892a9
- SHA1 70b6cf9eec8e6a56ca6dd81489b411324c918e0e
- SHA512 5e7e417b919a52647e0fecad56bee91eacf2e91d063d5fc15322d9049789cea3639089d9561d3f53fb7c0cd230a8cf8b2887e857df2e0810c8026248d1d4b26b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 72B
- SHA256 147472566cb59a300984ca4fe8e3ea404d7dd0942c0f30df53f6a9b910a2a359
- MD5 390a04192689e0ab8c528c272a98f061
- SHA1 5123c400ccde8b56615eaeb95a6dd3ec6caad548
- SHA512 d2279e4207a05390028ba1bc645cb293fac3af22859a0276d4660187b82afc9453949c679c9c0cc0fc7d2cde4b9dd072a6039f8bfccbc4b93bbd3e160935bd17
- TLSH T141A0029171401425C1585672D5C5D1D42754FC510B1A4F2573D6064D9AA12D04785112
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 22KB
- SHA256 fe4576dca0bab36ea309cdafe9a448a3da1ee2e1df7b3c9ecf04ab4eb95978e9
- MD5 c89fa1d04ae6285d2bcee2a8077139ef
- SHA1 baec1876da0187a8545ee0c8b13f50f20756e419
- SHA512 6280935f332bd2c29c5a27ee1725b0d6c22c7129fa6605992a3085f0c315612c249a01bc9955d60b7b47a5b117ac6035616e9c4f58b5d2968110db94ad4bb56f
- SSDEEP 192:cVSnNDxZ9l3iZ3QxVl/1hVPUfPYjsJ9rm:c8NDb9ViJQXlthlUnk
- TLSH T1B9A26916713A425238BD6D4CB3A68A374F4271633418E5AF7FB810B60E2AE125DFD8DD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 24KB
- SHA256 5058d98a4819f60bc28ea2743599af2b537b63b1b5aa37935539040fe94d5a75
- MD5 590eaa80c34b57262ad50e5938961102
- SHA1 7a3588abc7c6dd1f3f0937d6447f4cbc3a705e28
- SHA512 ea6ec4e75daa444a1b7b232a84dc1dae9956255fefbf51056a8b9f02403514e7c94cc649a36fb41b3689b66d1d48468f88c32e9666c9363fa79ff3fdaf2b1ac3
- SSDEEP 384:niHiF9CcmyWCs3sNE8TUNTUlI4k5JqLGCifbZocx8e/Lqw5Ycf2yF7IgM:iCFccps3dwgqkocSeuw5Ycf2N
- TLSH T1A0B23A32EC94CABBECE75E95F24A7603DEE45163C68C9AD4EAD81D1C01DB1AD130BC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 a1526a49dad0d2d3e8adf9c304f7ad497907dbcce08fbc91e6b6333547282bd0
- MD5 3b854999eb7e1e2365049559a6e36329
- SHA1 81c2fcb39c7d3487f0ac86b556b99f413488d971
- SHA512 785672f0c646e749360c537d0421fd449a2232ebb2d3bf4a651de1f5de27bf8adf46039ca5cf72035c4b12898f24d42f08409d3977a84842f547881fb5de0d51
- SSDEEP 384:nRAiFqtNn/s3n9SEl3sNE8TUNTUlI4A4TQpjWCifbZocx8e/Lqw5ffueQsUkY6FZ:RbFqj+993dwgf0ocSeuw5ffRUkt
- TLSH T17FD24B32E8A5DE7BECE64ED0F20A3A07EEE4516395885ED4E9DC6D4C01DB1AC1307C26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 e29660bbcf457cd42386abaaa9bd918abfa3636f772523d3f953cc7254326617
- MD5 f5b694cc6a91cec285e619273a138b03
- SHA1 8d8dfd9db08319a3112d7e931987834078bf1dec
- SHA512 84fd8fe5cb1dfe3a75f259bb2eb0e9e9a700a78ad1fb0763ed7c32396609a34a055e4c8920741b5b51fa991bad86ee4f113c28d701a0c2f89e3f6f737c6f4ff7
- SSDEEP 384:niHiF1tNn/s3n9Sz3sNE8TUNTUlI4k4TQJjWCifbZocx8e/Lqw5YBfueQsUkY6FZ:iCF1j+9y3dwgX0ocSeuw5YBfRUkt
- TLSH T18ED25B32E865DEBBECE64ED5F20A3A07EEE4516395885AD4E9DC6D4C01DB1AC0307C26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 33KB
- SHA256 9d1e3252c946dd8c2c1deb2ce4973dd623e89578892087c91851f18f796d4608
- MD5 9b5732af513f91a27dbfedd6f9c7244b
- SHA1 c8030b08d5648f4e318572b6a7d2144f498b670a
- SHA512 a17ce8d22f803fed2e82a56c00c06dd5bdc7ac3c87cd1c896d5893922a3ed8052f6d1b04a48d5922ec32396b08536a7a59676ba8dd1c26b715535ac4816826c2
- SSDEEP 384:nRAiFstNn/s3n9SEa3sNiq8TUNTUlI4A4TQdRSCifbZocx8e/Lqw54fueQsUkY6b:RbFsj+9C3TqwgZQocSeuw54fRUkt
- TLSH T18AE2D5F198D78977E89E4B83A33E2E069AFCC163B5885984F7985D0CCD961BFC306815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 24KB
- SHA256 fb3920af6b1570fb37388e60d55b6a5d66b83f3b451f6ef73aac4eec94ee9bb6
- MD5 61c05296e4a61f52b4f379d938d171d0
- SHA1 886783aec2750c9b49ea3e7836cccafcd65a4b3c
- SHA512 87a66efae477e6fbcfea0f2b743b466298274309a84b7e69df0cff4d55c588ac3c54815442ae23050fadb4c7f1ae041e283c4a1df2773099b0ae028f35f26753
- SSDEEP 384:nliF9CcmyWCs3sNZZ8TUNTUlImkrJ1UJCifbZocx8e/Lqw5g7ahkP+lFYS/PLF7O:sFccps30ZwgylocSeuw5g7ahkoFYS/Pg
- TLSH T17AB26C36EC98CABBEDEA4F95F74A7A43DEE01163949859D4EAD81D0C00CB1DD1307C26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 33KB
- SHA256 650f05e7c572efb71335c5f1e80b9387c445b2832ed0be566ea8646c6984beb6
- MD5 16a0ef3954d977ca013e9363bbb476fd
- SHA1 0516fcdb5af36bd8238f5896b8d057974688fe58
- SHA512 d52b9830fb29ef3e5ea750675e67f6e10174340416963703bbc56343e2d83ad77e05e7d379f369bb731aa838905edefe424f4a1bc3fd5b9285b2894c41e2ff13
- SSDEEP 384:nRAiFV7tNn/s3n9SER3sNiq8TUNTUlI4A4TQ/RSCifbZocx8e/Lqw5MfueQsUkYq:RbFV7j+9Z3TqwgLQocSeuw5MfRUkt
- TLSH T12DE2D5F198D78977E89E4B83A33E2E069AFCC163B5885984F7985D0CCD961BFC306815
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 28KB
- SHA256 9fe1360c306e0326b7ef04e3dd134642077f3bede2574467091f547a864e1bf1
- MD5 69c2973b885beaa43efe4e9c1755576d
- SHA1 4e4e17a72ecbd99c6344ca4688fba35ed1ae5750
- SHA512 b2c1ccb439d4227e008e5afb4f06d48b1efc0cebac04248da227667d6db27b8b96f7c82bcfc7d138aea1d360e858751ae59a45801e8744115e1e9d6b18efd656
- SSDEEP 384:nRHiF1tNn/s3n9Sz3sNE8TUNTUlI4k4TQJjWCifbZocx8e/Lqw5YBfueQsUkY6FZ:RCF1j+9y3dwgX0ocSeuw5YBfRUkt
- TLSH T179D25B32E865DEBBECE64ED5F20A3A07EEE45163D5885AD4E9DC6D4C01DB1AC0307C26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 25KB
- SHA256 529d98a6cf422d40d4af67663f7f71cf46b4bec659bfbf1d8475521d583976b2
- MD5 f7e59fd58eb3aacbf90bf00cd8902a5d
- SHA1 aedde40fcf15a5fd3c940046bd171b8e2af6a1af
- SHA512 e90c0dacdcfb2f49a36c4a1a9295dbe40242430d0116f13bcc9becc927f8214c205c3ef3993d64c742eb6117dd2a040eda22c039e74338c36f968529dc5e35e6
- SSDEEP 384:noiF9CcmyWCs3sNg8TUNTUlImkrJndzCifbZocx8e/Lqw5YkfhkP+lFYS/PLF7IL:zFccps3twgNTocSeuw5YkfhkoFYS/Pg
- TLSH T1CDC25C32EC98CAABEDE65FD1F64A7943DEE44163C58C9AD4EAD81D1C00DB1AD130BC16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 4838f167f8c6de9b16e078a1a4194c08c98e5e106ce68a40eda3601d16f409da
- MD5 3491155ddc84e430f95f56a256dee8e1
- SHA1 177ed2fa2538944525c0b1d750824dbfb3544f65
- SHA512 a81fbab21c6929bdc4155185370d0c1bc2314b56e42f3903fea47fb69febd3e2787e6973e15958ab585762357af691b0572b8415cad4a50403635bfda4477d11
- TLSH T149E00902138200EAD465133081D71F21AEE2812112B21316473112790C333413E20BD0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 9639f6b26e9984ed2ee0eaddbd2dfb665b0087b0a4c31842c1a52d3611657938
- MD5 669ef2aa65eeb5ba1bc9cd83b7fe61af
- SHA1 6ee95a49cbf9e4f43cbc82f4648e3c13ee045e42
- SHA512 f51083630a461d077783b4aa5e998e563e1f1f6e0e1a655216a017a2aebe129524d67f634a688c3d8633ac4f63f809804d238dea832136b1a858f932da3d3a8e
- TLSH T127E00102134100EDD461133041931F319FE3C131117213164B31016D0C333413F20BD0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
- Size 392B
- SHA256 333c8fd0717b94b684cb6b577de563704bf5739a0f54d7dea56d3f516f950320
- MD5 44c53c6361e904f1411d3eb9455ae560
- SHA1 44ef441487af1dfc62107258b61a525a6325f9b3
- SHA512 297a9c630a65e3a0847192ff95511562076d4ad06d629bb64e9b0413c6361315f32dde209de0c78eca072a5133ab85c39779ce91268fa9fbb54cb4d328169e7c
- TLSH T14BE00912934200FDD465133082A71F70AFE2C12112B213074732126A2C333413F34FD0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59190c.TMP
- Size 392B
- SHA256 54e28426d8f185c251ac683aeed044e8995fc926309fcd35062daed262151d10
- MD5 bb534815d0a0d52d643204ad128fb1eb
- SHA1 318f7fb971f525187235b3edef57914e2a09092b
- SHA512 18d1eec84f327c485df7b744e31f1947e68837e1293e0b7329f4e6d811a63c65b281152bf85f0d9e639a747418d7b7bb986e42a881f69e8e72261ec69902d23f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 e82de1198626050e342406f2f88e1bf4c45e9f1a47b857934be3b925a1942dae
- MD5 2fd1a84267e9e3efd81fc15cbf17d346
- SHA1 1521186a21f29dafd32a9184b456f433d20ad27f
- SHA512 84c4d0156a84dadb8620fc025d08639c4b2d7b18d515ccdd2ef8df31cfd235cdc8afca118b015b00206073dfdf321ab5cf9f9450180efefe37158fbc8f281628
- TLSH T1AF410B68A6F91148B3B76F1A9BF6A86D487E7C672E06945E00010E4E0A67B40C8B1B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2500\banner.jpg_1
- Size 17KB
- SHA256 6cf8749ec1e8707785d80385943202d4ae23938b685c9a51be20a7b3f5ff7082
- MD5 1728b929d3842941cccaf94722bb549e
- SHA1 b5c3efc573cc09ea5c28c569cf72675165e2fe43
- SHA512 7bd02dbc6e03c6c71dbcbdb31a4bc667ddb3c4f9c0a26918c82624b1a06b4f9e938a96d667957a43b98a65ad230eb02e7f0cd88ff92b583cca4a94a54b14a31d
- SSDEEP 384:mZXAlzy2yXbl57FPRvBOfQuBhuII47ozAiX0l5Wxlb:mZX0yLD7FPREhuIRcAv6lb
- TLSH T1DE82D095C352A0E89CD865EF4CF93604E33610D6E622F322CEE2B8C5E76909D319F438
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2500\dialog.jpg_1
- Size 50KB
- SHA256 38baa3126fc159e33257caa77cc277993bca5233cd9ff45683ac963e80ddcbdf
- MD5 4107146facf250b451d6eb8fedb4371a
- SHA1 816223ecc1e3e7db923b975a0d80e05a65f7d6a5
- SHA512 44964e7ad0f95adcc75306eb5149e8642c75ba55297e9714e8d109142b79810b9d675877e404de2ebd5f7455d1c684b2b9928e5ad35f992d15a60d8d9582fc4c
- SSDEEP 768:ROnAmtqd0Xw49mY7zbVyBFOQs8SWBMvcSjRP98YhBss2Fju063nVt6F/OvZ:ROjtqD4QY7zber4c8RP+uZ2b6Xv6JUZ
- TLSH T1C033BFB5F3DBF359AB0B01AC823EBDB3071298D519E48643246B1E02D268F70719797D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\INA6F89.tmp
- Size 1.1MB
- SHA256 7d32c3f22aba69ab7c881b54aa40cc92710630d9e49f861eb1535199780b4f52
- MD5 948cdfa1cf23767bc780e1352fcdee94
- SHA1 45a8371426110ff8e809d5c21e356ea535232872
- SHA512 db5289781f56f3ed809ab7993d2e9d8e018d98e8bf74bbf287ed37dcd8102d75ebeb81d5ee537d103ac97a090d3ec4f9944164d03c518d14a89de2de0d3887b9
- SSDEEP 24576:UUL/equeyM0i+B7Q3ImKKF+Oh0lhSMXl8Gek9ApQhqAfEEx4D9sF:ieyMlqQtKIOsGr9ApQhqAfEEx4D9sF
- TLSH T1A245F724EC2E8572FE5F11729617772BE06C1DD01B7058DF82A9C8D61D722CBA239F86
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7027.tmp
- Size 1019KB
- SHA256 15c35c5abf7bab8d1375f5622e31da14fd027ae1046b8a6ddfd74263fa34eda6
- MD5 2330ebbe491c6026af5e8853f3692798
- SHA1 6c62d81f6c90046714705bec931815a908b760ac
- SHA512 81747ead7869f68e499a53537588d35485b5fd2b4505856cd589bca1f7296d971e78f3fd57a1c1d931dfe6c2668888b26eff49a96ecd740ecd1b271eb7058201
- SSDEEP 24576:T21SlOwxeXfwNTELVJh0lhSMXl3SG5vHqU4duDfCK:ToS9xeXf7LKnSG5vHqU4duDfCK
- TLSH T114256C203A4AC436F6AE01F2693D9A6BA07F79BA1B7144C753D4BD7A28704C25739F13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI726C.tmp
- Size 1.2MB
- SHA256 6e7cdab18e1f705c0ea56a565577db0389ece2b5a4e0f31d3063e9103f59fbee
- MD5 c9ef0378879c57a38c075bb28b88fcab
- SHA1 dd27d17d691ffddaadd8bd6de532bc9f8b2c4a3e
- SHA512 94cca46aafe7138904a79693e0c97e0d72a0542e4d7a8a6778b4d4f0e68aa3dd90e7dbc0b34832a8875b10f32c3ca2bbaab446da0689c74ca295af4490c6783f
- SSDEEP 24576:AMsSFgim2N2/YBtbDeC5sBAbwjHtAR5ddfKFT3Lt4gGLAl+quHMlKJM4L1aLKc7W:AliN15sBAbwjHtS5DfKFT3zGLAl+quHH
- TLSH T1EF450931AD7C457AEF6F89B096575226F95D29D21BA088EF82E0D44722311D3E331BCB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI74BF.tmp
- Size 917KB
- SHA256 0fa9b28d3bb8e455ad61735f5259d5d9b8f65bcefa44f83f69db8a4ca451e5bd
- MD5 afa8190a561a082dcc094e9ff8abdb4a
- SHA1 3817097816d20ccbe8754e6c58bbbde937af9a20
- SHA512 3deb8f142dc287246ab17cf45c1c501ffe39cd1e089d6b6d90cac8d958f873764615cdaf37be08cda19bc8354ca9ee94a8518d425802d3a289ea74a364a0f952
- SSDEEP 24576:SQemY/mbo0ha/8EoUVSwAnA7h0lhSMXl0uVGgwiLFpZIH:SQXo0pMVSPDk2GgwiLFpZIH
- TLSH T1AE157C71268EC036F26E91B02B3D8E7F911D6E764BB108D763D4AD6A56314C2433AE37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSI7F4A.tmp
- Size 334KB
- SHA256 3311ac863a98378e1b5ade58c814158f350067c2a96a095eee63ba19b6ef2e22
- MD5 67425672440ac762d3dd7c1cd3746c7d
- SHA1 3332b4c89cb6ad8acee47904446dd3f8d76130be
- SHA512 484c46ab834f8732ca7c0afc77fbce68f5cba1783ec2889e4283fe6ce76b569b06501d47f14ed8aaeaebcd0c480c45bbaed18eccabd64e22f5a1319cc1e31dfc
- SSDEEP 6144:DsbvBbhOr4+T1lqK0rklph0lhSMXlBXBW/+BOA:Dsbhwtl6klph0lhSMXle+EA
- TLSH T12E74B020A956C033D65E0E307D6A8FEB9A3D5EA14FA164CF73DC2DB54E702C16739A09
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\URL1B4A.url
- Size 65B
- SHA256 adf4707340269432553415ee4008223152c58a15118a54ab88d596a0890e7e31
- MD5 2a877bcf3be14b26e0a97abc9dc6898b
- SHA1 2a718613777d7512deb1a6099a8ebddc3c368fe8
- SHA512 e6348bcf86c09c67ae246b10cdd71b4cffbe4951256f3edc3df4b21a3c2e42ec73464136dcec3359e5edfda040d7b481eff2f5fdef99b88bdc08c399da5f743c
- TLSH T107A022C3C20CC0FC8A82C2CC2030C200C80320E0C282C0C083C0BE80088B02302C0A8B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN 5.2.1.8262\install\CBCB962\UrbanVPN.msi
- Size 9.3MB
- SHA256 ab0ce1bf50a28a8b281bad1046c889135736f48bbc100157548e056fc4b3f322
- MD5 2fc279aadf2ee5f72ce1740b80ecfded
- SHA1 cbe6f747a770cd85c78022e0f826d52d7564fb60
- SHA512 d2f6efa82b4b9df717bd305e57be230cf20467c1e01f77003b41d8b095ffd8b9227a9b578e2723407ea9d2f314ae30651dc90475595f0720c6a8ac4544978b01
- SSDEEP 196608:lZB3spHOFT3FykUwHMXBiJAISpGaaaa8arab7aa7a:l33spHOFT1y24BiJ
- TLSH T1A4A6AF20BD5EC036E66F01719A2AAA2BE53D7CE10BB048CB53D4B8AA1D315C39735F57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\MBSetup-3.3.exe
- Size 2.7MB
- SHA256 0385b06957b7f5b2c3c7132f8ebd8414f64f00407ea2baf07acbffa8d6eca334
- MD5 b2416edb738fa965cc0d0405322a24c1
- SHA1 d09de4354bafc2026084c1d3a8f59514a1d430f3
- SHA512 a4409884cefb389bf12f2f8ab2f0b74539e1a1c8b63f885728f4424091886450facf4e18e137bc6e5cb1e92329957de57099ad04c0433e9a4bc086e5a1238a76
- SSDEEP 49152:yg9zAA9HY7oomwAeyfvE0Z3R0Tnxn1o2d5Hptj4LC:BdAA9HY1AeKtwnW2f
- TLSH T112D59E31B2D18020D5B39270297EA7EB5B79BC256F7640CF32D8B6390B725C0AD75B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI18E0.tmp
- Size 423KB
- SHA256 eb21efa033f38f24d87c1c259055a2618168268881be6ae06d734450fdf65f82
- MD5 18cda9f5769af8d162f93889de623514
- SHA1 cbb2d0ef2baa765715c67fcd9766f2fea3af1fa8
- SHA512 bcca4f6dd4acf4a61b36ce5ad058c15535812de7362950959ff0373352b640fc8121b64523be6fc785aa603fe3441fce8a8b589a7ef9b11838eca6ff9b24cc2e
- SSDEEP 6144:KVBkP0VtAJfL8A5elIDqacjFxqavMGuaCwph0lhSMXlBXBW/k4p6GMhyB:4WMIWhZ7Cwph0lhSMXl2k86yB
- TLSH T1EA94BF20B98AC032D61F05705D78AFAA8B2D7D614FE494CB93DC6CBB4D725C25B35A0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI740.tmp
- Size 329KB
- SHA256 a64119f041734f2eca66cb32ad397afeae9e793f3eab144dfdb1b48692f2ce6f
- MD5 4595a3ee93deb2ffe37d7fd86792115f
- SHA1 efe80ce610b4f4e456f1c99110e6749c5a87d48f
- SHA512 0768af55f3d04ea0b41de2609558fb3234f9f7cf80b44e8815abe301dd4c972d49427107b7829939ac0a1c6925a075a524a085d248ffa9c9ee1b8a509c7a494a
- SSDEEP 6144:xAm3R1zPBgbxjOka7nU8mlxMFmm1v9AGhWnC:xn3eb1a7nxEAzv3
- TLSH T1BE747C19B3A504B8E0B7927CC9A35906E7B67C160361D6CF23E046562F33BE4993EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e59dc01.msi
- Size 208KB
- SHA256 59a148da299c73d6bd4ef9a8e99736c3d3eabb3b9f895ad8ab183b657516cc22
- MD5 cbb2aeab99bcc3085738c1c41fdf3225
- SHA1 9462fcbb04046d68df7250f5124e79c269f771b2
- SHA512 aec8238b7d7a4727b1f3fdcd5d3c6064bf72af6da5d8ef6542fe5fd97b8e24b7d15540426fae029a628d7e160f9fb31fc482edccc416d970f93656ecad0fd5e7
- SSDEEP 3072:S9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTYBp:claZeKFxCnBheIdluO
- TLSH T1B824AE12B5808033DAFE1A350578DB615F3D7E608E54899B6364B6AD1E707C0CF3AAB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{145C6174-96A3-49A0-ABCC-6C078C1312EB}\.ba\logo.png
- Size 1KB
- SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
- MD5 d6bd210f227442b3362493d046cea233
- SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
- SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
- TLSH T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{145C6174-96A3-49A0-ABCC-6C078C1312EB}\.be\VC_redist.x64.exe
- Size 670KB
- SHA256 1ec6ded595b12262d8bfcf8436046c9d84febff424924cb839a1946dad76ca4e
- MD5 261f741c93973d184d4fccf833f0c075
- SHA1 cb7846fc45cc545b3ac6ab0aa3425461e219b196
- SHA512 90ca6a11c6bbd5f97d1ed146da5279bf40330bf9020b40eb816ede0d914ed4d769e9c48cb8c839924700dec818d4f818f89e6d6afbc7091e2a2809ebe099da81
- SSDEEP 12288:Z3mgqnIZuYfCYqFet4CovkM7pu1nEMSgKZLrfDDIcbMZ3MyGb:Z3WnIZuMCxezot7ohEDfDBMZ8yM
- TLSH T120E49D32A5614033F7F10573B928A6303E7CE3282B51C8A9D7D4AD1D7EB4892A7F7256
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{7A92BD85-D869-4D77-9736-1F5ECE0C3A77}\.ba\wixstdba.dll
- Size 215KB
- SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
- MD5 f68f43f809840328f4e993a54b0d5e62
- SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
- SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
- SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
- TLSH T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{FB253C91-FE5A-46BC-869E-B66F09DF3B87}\.ba\license.rtf
- Size 9KB
- SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
- MD5 04b33f0a9081c10e85d0e495a1294f83
- SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
- SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
- SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
- TLSH T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\{FB253C91-FE5A-46BC-869E-B66F09DF3B87}\.ba\thm.wxl
- Size 2KB
- SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
- MD5 fbfcbc4dacc566a3c426f43ce10907b6
- SHA1 63c45f9a771161740e100faf710f30eed017d723
- SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
- TLSH T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\{FB253C91-FE5A-46BC-869E-B66F09DF3B87}\.ba\thm.xml
- Size 8KB
- SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
- MD5 f62729c6d2540015e072514226c121c7
- SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
- SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
- SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
- TLSH T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
- MD5 SHA1 SHA512 SSDEEP TLSH