hxxps://www[.]urban-vpn[.]com/

Analysis

user interaction
yes
max time kernel
124s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/07/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.urban-vpn.com/
Sample260709-rydfaacy6x

Score

8^/10

defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
233	4452	msedge.exe
233	4452	msedge.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\ovpn-dco.sys	DrvInst.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	Urban Vpn Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	urban-vpn-app.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	Urban Vpn Updater.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	UrbanVPN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	VC_redist.x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	MSI8C74.tmp

Executes dropped EXE 18 IoCs

pid	Process
3040	UrbanVPN.exe
4220	UrbanVPN.exe
1912	VC_redist.x64.exe
3616	VC_redist.x64.exe
1148	VC_redist.x64.exe
4304	VC_redist.x64.exe
3436	VC_redist.x64.exe
3048	VC_redist.x64.exe
3704	UrbanVPN.exe
2448	VC_redist.x64.exe
1800	MSI8C74.tmp
752	Urban Vpn Updater.exe
5160	urban-vpn-service.exe
5684	Urban Vpn Updater.exe
5732	Urban Vpn Updater.exe
1708	urban-vpn-app.exe
4956	Urban Vpn Updater.exe
2756	urban-vpn-app.exe

Loads dropped DLL 64 IoCs

pid	Process
3040	UrbanVPN.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
3040	UrbanVPN.exe
3616	VC_redist.x64.exe
4264	VC_redist.x64.exe
2344	MsiExec.exe
2344	MsiExec.exe
2344	MsiExec.exe
2344	MsiExec.exe
2344	MsiExec.exe
2344	MsiExec.exe
3692	MsiExec.exe
3692	MsiExec.exe
2344	MsiExec.exe
2344	MsiExec.exe
2344	MsiExec.exe
3692	MsiExec.exe
3692	MsiExec.exe
3692	MsiExec.exe
2344	MsiExec.exe
3048	VC_redist.x64.exe
2344	MsiExec.exe
2344	MsiExec.exe
2344	MsiExec.exe
2344	MsiExec.exe
2344	MsiExec.exe
2344	MsiExec.exe
3692	MsiExec.exe
3692	MsiExec.exe
4960	MsiExec.exe
4960	MsiExec.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe
5160	urban-vpn-service.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{77169412-f642-45e7-b533-0c6f48de12f9} = "\"C:\\ProgramData\\Package Cache\\{77169412-f642-45e7-b533-0c6f48de12f9}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{77169412-f642-45e7-b533-0c6f48de12f9} = "\"C:\\ProgramData\\Package Cache\\{77169412-f642-45e7-b533-0c6f48de12f9}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UrbanVPN = "\"C:\\Program Files\\UrbanVPN\\Urban Vpn Updater.exe\" /checknow -minuseractions -restartapp \"C:\\Program Files\\UrbanVPN\\bin\\urban-vpn-app.exe\" -restartappcmd \"--tray-minimized\""	msiexec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
251	3692	MsiExec.exe
252	3692	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	UrbanVPN.exe
File opened (read-only)	\??\W:	UrbanVPN.exe
File opened (read-only)	\??\Y:	UrbanVPN.exe
File opened (read-only)	\??\Z:	UrbanVPN.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	UrbanVPN.exe
File opened (read-only)	\??\H:	UrbanVPN.exe
File opened (read-only)	\??\K:	UrbanVPN.exe
File opened (read-only)	\??\R:	UrbanVPN.exe
File opened (read-only)	\??\H:	UrbanVPN.exe
File opened (read-only)	\??\N:	UrbanVPN.exe
File opened (read-only)	\??\V:	UrbanVPN.exe
File opened (read-only)	\??\Y:	UrbanVPN.exe
File opened (read-only)	\??\J:	UrbanVPN.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	UrbanVPN.exe
File opened (read-only)	\??\S:	UrbanVPN.exe
File opened (read-only)	\??\Q:	UrbanVPN.exe
File opened (read-only)	\??\P:	UrbanVPN.exe
File opened (read-only)	\??\U:	UrbanVPN.exe
File opened (read-only)	\??\B:	UrbanVPN.exe
File opened (read-only)	\??\P:	UrbanVPN.exe
File opened (read-only)	\??\X:	UrbanVPN.exe
File opened (read-only)	\??\M:	UrbanVPN.exe
File opened (read-only)	\??\B:	UrbanVPN.exe
File opened (read-only)	\??\O:	UrbanVPN.exe
File opened (read-only)	\??\T:	UrbanVPN.exe
File opened (read-only)	\??\W:	UrbanVPN.exe
File opened (read-only)	\??\L:	UrbanVPN.exe
File opened (read-only)	\??\V:	UrbanVPN.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	UrbanVPN.exe
File opened (read-only)	\??\I:	UrbanVPN.exe
File opened (read-only)	\??\S:	UrbanVPN.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	UrbanVPN.exe
File opened (read-only)	\??\E:	UrbanVPN.exe
File opened (read-only)	\??\L:	UrbanVPN.exe
File opened (read-only)	\??\Q:	UrbanVPN.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\T:	UrbanVPN.exe
File opened (read-only)	\??\M:	UrbanVPN.exe
File opened (read-only)	\??\J:	UrbanVPN.exe
File opened (read-only)	\??\R:	UrbanVPN.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	UrbanVPN.exe
File opened (read-only)	\??\U:	UrbanVPN.exe
File opened (read-only)	\??\X:	UrbanVPN.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	urban-vpn-service.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D76868C250B3240414CE3EFBB12518_C52F6434370270B2A9D78C68114E1F64	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_05A785F007767E0C96A5E00A3CF3E499	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8	urban-vpn-service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b2c02d0a-39c8-d649-ae13-27bdc61c64e7}\ovpn-dco.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b2c02d0a-39c8-d649-ae13-27bdc61c64e7}\SETED56.tmp	DrvInst.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	urban-vpn-service.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b2c02d0a-39c8-d649-ae13-27bdc61c64e7}\ovpn-dco.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_9eb49abe443cc94d\ovpn-dco.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b2c02d0a-39c8-d649-ae13-27bdc61c64e7}	DrvInst.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8	urban-vpn-service.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959	urban-vpn-service.exe
File created	C:\Windows\System32\DriverStore\Temp\{b2c02d0a-39c8-d649-ae13-27bdc61c64e7}\SETED45.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b2c02d0a-39c8-d649-ae13-27bdc61c64e7}\SETED56.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_9eb49abe443cc94d\ovpn-dco.PNF	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Urban Cyber Security\UrbanVPN\service	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\064D75DF60A1456F63CEF9F347BAA00B_E54FB72B2D8B865F329FB65A1441F61C	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_05A785F007767E0C96A5E00A3CF3E499	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1AE0966C60D0B0CA32EDFE5BEBC2A908	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1AE0966C60D0B0CA32EDFE5BEBC2A908	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\949D2E01833511C6366A8B529939FE66_E80B95907B62816351718DBAEA6F9F40	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\064D75DF60A1456F63CEF9F347BAA00B_E54FB72B2D8B865F329FB65A1441F61C	urban-vpn-service.exe
File created	C:\Windows\System32\DriverStore\Temp\{b2c02d0a-39c8-d649-ae13-27bdc61c64e7}\SETED44.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\UrbanVPN\bin\d3dcompiler_47.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6Core.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\qmltooling\qmldbg_local.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\tls\qcertonlybackend.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQml\WorkerScript\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Material\impl\qtquickcontrols2materialstyleimplplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Universal\impl\qtquickcontrols2universalstyleimplplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Templates\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\dxil.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\win10\ovpn-dco.sys	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_gd.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_it.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_nl.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_ru.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\platforms\qwindows.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\UrbanVpn\UiControls\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_nn.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6Gui.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\FluentWinUI3\qtquickcontrols2fluentwinui3styleplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_ka.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\Qt\labs\platform\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtCore\qtqmlcoreplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQml\WorkerScript\workerscriptplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6LabsPlatform.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6Quick3DUtils.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6QuickControls2Universal.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtCore\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQml\Models\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Fusion\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Material\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Windows\impl\qtquickcontrols2windowsstyleimplplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\urban-vpn-service.exe	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\qmltooling\qmldbg_messages.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\FluentWinUI3\impl\qtquickcontrols2fluentwinui3styleimplplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Fusion\impl\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Imagine\impl\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Templates\qtquicktemplates2plugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\UrbanVpn\UiGlobal\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\UrbanVpn\UiGlobal\UrbanVpn_UiGlobalplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\Urban Vpn Updater.exe	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6OpenGL.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\imageformats\qgif.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Effects\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_fi.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_fr.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_sv.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6VirtualKeyboard.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\opengl32sw.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6Network.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6QuickControls2.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6QuickControls2FusionStyleImpl.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\imageformats\qtiff.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQml\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\qtquickcontrols2plugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\dxcompiler.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\UrbanVpn_UiControls.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\imageformats\qwbmp.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Imagine\impl\qtquickcontrols2imaginestyleimplplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\impl\qtquickcontrols2implplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\NativeStyle\qtquickcontrols2nativestyleplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Window\quickwindowplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Basic\qtquickcontrols2basicstyleplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6QmlMeta.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\qmltooling\qmldbg_nativedebugger.dll	msiexec.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8C74.tmp	msiexec.exe
File created	C:\Windows\Installer\{DD85AE10-FF9A-48FF-91E6-3C427CBCB962}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA493.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e595337.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7370.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI89FE.tmp	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI54CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5CCE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D4B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F9F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6FCF.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\Installer\MSI7331.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B19.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	urban-vpn-service.exe
File opened for modification	C:\Windows\Installer\MSI74CB.tmp	msiexec.exe
File created	C:\Windows\Installer\{DD85AE10-FF9A-48FF-91E6-3C427CBCB962}\urbanvpnapp.exe	msiexec.exe
File created	C:\Windows\Installer\e595337.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F4F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI701E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{DD85AE10-FF9A-48FF-91E6-3C427CBCB962}\SystemFoldermsiexec.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA55F.tmp	msiexec.exe
File created	C:\Windows\INF\oem3.PNF	urban-vpn-service.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\e59535f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7310.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59534a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5F7E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI87E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e595349.msi	msiexec.exe
File created	C:\Windows\Installer\e59534a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8B2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI57DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI707E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI749A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI74AB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9B2A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8BD7.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{560D2DA4-096E-4868-B22A-DA6418FDE6FB}	msiexec.exe
File created	C:\Windows\Installer\e595360.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI847C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E0A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DD85AE10-FF9A-48FF-91E6-3C427CBCB962}	msiexec.exe
File opened for modification	C:\Windows\Installer\e595360.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI89FD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{DD85AE10-FF9A-48FF-91E6-3C427CBCB962}\urbanvpnapp.exe	msiexec.exe
File created	C:\Windows\Installer\e595362.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6F7F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI703F.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\SourceHash{5904914B-9FC8-44C2-AE48-5C7F30A603EC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8ABA.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UrbanVPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Urban Vpn Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Urban Vpn Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Urban Vpn Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UrbanVPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UrbanVPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI8C74.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Urban Vpn Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4452	msedge.exe
4408	msedge.exe
6000	msedge.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	urban-vpn-service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	urban-vpn-app.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	urban-vpn-service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	urban-vpn-service.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	urban-vpn-service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	urban-vpn-service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	urban-vpn-service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	urban-vpn-service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	urban-vpn-app.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	urban-vpn-service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	urban-vpn-service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	urban-vpn-service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	urban-vpn-service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	urban-vpn-app.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	urban-vpn-app.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	urban-vpn-service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	urban-vpn-app.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	urban-vpn-app.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	urban-vpn-service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	urban-vpn-app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	urban-vpn-service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)"	urban-vpn-service.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave"	urban-vpn-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	urban-vpn-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	urban-vpn-service.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update"	urban-vpn-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	urban-vpn-service.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	urban-vpn-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E	urban-vpn-service.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption"	urban-vpn-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280813570129231"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33816"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\urban\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B41940958CF92C44EA84C5F7036A30CE\VC_Runtime_Additional	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{77169412-f642-45e7-b533-0c6f48de12f9}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01EA58DDA9FFFF84196EC324C7CB9B26\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{2427F401-E951-48F2-AE1B-99D0C02138EE}	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\VC,REDIST.X64,AMD64,14.30,BUNDLE\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Urban Cyber Security\\UrbanVPN 5.2.1.8262\\install\\CBCB962\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\urban\ = "URL:Urban Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\urban\shell\open\command\ = "\"C:\\Program Files\\UrbanVPN\\bin\\urban-vpn-app.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B41940958CF92C44EA84C5F7036A30CE\Servicing_Key	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\ProductIcon = "C:\\Windows\\Installer\\{DD85AE10-FF9A-48FF-91E6-3C427CBCB962}\\urbanvpnapp.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Version = "14.40.33816"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Version = "14.40.33816"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\urban\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D15EE4AAF3E53D9488CC68E460CB755B\01EA58DDA9FFFF84196EC324C7CB9B26	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{5904914B-9FC8-44C2-AE48-5C7F30A603EC}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{77169412-f642-45e7-b533-0c6f48de12f9}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents\{77169412-f642-45e7-b533-0c6f48de12f9}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01EA58DDA9FFFF84196EC324C7CB9B26\C4FE6FD5B7C4D07B3A313E754A9A6A8	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Version = "237536280"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\4AD2D065E69086842BA2AD4681DF6EBF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\urban\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\01EA58DDA9FFFF84196EC324C7CB9B26	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{560D2DA4-096E-4868-B22A-DA6418FDE6FB}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\urban\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\SourceList\PackageName = "UrbanVPN.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\01EA58DDA9FFFF84196EC324C7CB9B26\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\ = "{77169412-f642-45e7-b533-0c6f48de12f9}"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B41940958CF92C44EA84C5F7036A30CE\Provider	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c000000010000000400000080010000030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd819000000010000001000000011a2b3490cb6c379a89e76c3569452d72000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	urban-vpn-service.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	urban-vpn-service.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1708	urban-vpn-app.exe
2756	urban-vpn-app.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
4644	MsiExec.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe
3040	UrbanVPN.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1708	urban-vpn-app.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3608	msiexec.exe
Token: SeCreateTokenPrivilege	3040	UrbanVPN.exe
Token: SeAssignPrimaryTokenPrivilege	3040	UrbanVPN.exe
Token: SeLockMemoryPrivilege	3040	UrbanVPN.exe
Token: SeIncreaseQuotaPrivilege	3040	UrbanVPN.exe
Token: SeMachineAccountPrivilege	3040	UrbanVPN.exe
Token: SeTcbPrivilege	3040	UrbanVPN.exe
Token: SeSecurityPrivilege	3040	UrbanVPN.exe
Token: SeTakeOwnershipPrivilege	3040	UrbanVPN.exe
Token: SeLoadDriverPrivilege	3040	UrbanVPN.exe
Token: SeSystemProfilePrivilege	3040	UrbanVPN.exe
Token: SeSystemtimePrivilege	3040	UrbanVPN.exe
Token: SeProfSingleProcessPrivilege	3040	UrbanVPN.exe
Token: SeIncBasePriorityPrivilege	3040	UrbanVPN.exe
Token: SeCreatePagefilePrivilege	3040	UrbanVPN.exe
Token: SeCreatePermanentPrivilege	3040	UrbanVPN.exe
Token: SeBackupPrivilege	3040	UrbanVPN.exe
Token: SeRestorePrivilege	3040	UrbanVPN.exe
Token: SeShutdownPrivilege	3040	UrbanVPN.exe
Token: SeDebugPrivilege	3040	UrbanVPN.exe
Token: SeAuditPrivilege	3040	UrbanVPN.exe
Token: SeSystemEnvironmentPrivilege	3040	UrbanVPN.exe
Token: SeChangeNotifyPrivilege	3040	UrbanVPN.exe
Token: SeRemoteShutdownPrivilege	3040	UrbanVPN.exe
Token: SeUndockPrivilege	3040	UrbanVPN.exe
Token: SeSyncAgentPrivilege	3040	UrbanVPN.exe
Token: SeEnableDelegationPrivilege	3040	UrbanVPN.exe
Token: SeManageVolumePrivilege	3040	UrbanVPN.exe
Token: SeImpersonatePrivilege	3040	UrbanVPN.exe
Token: SeCreateGlobalPrivilege	3040	UrbanVPN.exe
Token: SeCreateTokenPrivilege	3040	UrbanVPN.exe
Token: SeAssignPrimaryTokenPrivilege	3040	UrbanVPN.exe
Token: SeLockMemoryPrivilege	3040	UrbanVPN.exe
Token: SeIncreaseQuotaPrivilege	3040	UrbanVPN.exe
Token: SeMachineAccountPrivilege	3040	UrbanVPN.exe
Token: SeTcbPrivilege	3040	UrbanVPN.exe
Token: SeSecurityPrivilege	3040	UrbanVPN.exe
Token: SeTakeOwnershipPrivilege	3040	UrbanVPN.exe
Token: SeLoadDriverPrivilege	3040	UrbanVPN.exe
Token: SeSystemProfilePrivilege	3040	UrbanVPN.exe
Token: SeSystemtimePrivilege	3040	UrbanVPN.exe
Token: SeProfSingleProcessPrivilege	3040	UrbanVPN.exe
Token: SeIncBasePriorityPrivilege	3040	UrbanVPN.exe
Token: SeCreatePagefilePrivilege	3040	UrbanVPN.exe
Token: SeCreatePermanentPrivilege	3040	UrbanVPN.exe
Token: SeBackupPrivilege	3040	UrbanVPN.exe
Token: SeRestorePrivilege	3040	UrbanVPN.exe
Token: SeShutdownPrivilege	3040	UrbanVPN.exe
Token: SeDebugPrivilege	3040	UrbanVPN.exe
Token: SeAuditPrivilege	3040	UrbanVPN.exe
Token: SeSystemEnvironmentPrivilege	3040	UrbanVPN.exe
Token: SeChangeNotifyPrivilege	3040	UrbanVPN.exe
Token: SeRemoteShutdownPrivilege	3040	UrbanVPN.exe
Token: SeUndockPrivilege	3040	UrbanVPN.exe
Token: SeSyncAgentPrivilege	3040	UrbanVPN.exe
Token: SeEnableDelegationPrivilege	3040	UrbanVPN.exe
Token: SeManageVolumePrivilege	3040	UrbanVPN.exe
Token: SeImpersonatePrivilege	3040	UrbanVPN.exe
Token: SeCreateGlobalPrivilege	3040	UrbanVPN.exe
Token: SeCreateTokenPrivilege	3040	UrbanVPN.exe
Token: SeAssignPrimaryTokenPrivilege	3040	UrbanVPN.exe
Token: SeLockMemoryPrivilege	3040	UrbanVPN.exe
Token: SeIncreaseQuotaPrivilege	3040	UrbanVPN.exe
Token: SeMachineAccountPrivilege	3040	UrbanVPN.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
3040	UrbanVPN.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe
3916	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3040	UrbanVPN.exe
3040	UrbanVPN.exe
1912	VC_redist.x64.exe
3616	VC_redist.x64.exe
1148	VC_redist.x64.exe
2064	VC_redist.x64.exe
4264	VC_redist.x64.exe
2864	VC_redist.x64.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2936	1696	msedge.exe	87
PID 1696 wrote to memory of 4452	1696	msedge.exe	88
PID 1696 wrote to memory of 1528	1696	msedge.exe	89
PID 1696 wrote to memory of 1528	1696	msedge.exe	89
PID 1696 wrote to memory of 4108	1696	msedge.exe	90
PID 1696 wrote to memory of 4108	1696	msedge.exe	90
PID 1696 wrote to memory of 4108	1696	msedge.exe	90
PID 1696 wrote to memory of 3952	1696	msedge.exe	92
PID 1696 wrote to memory of 3952	1696	msedge.exe	92
PID 1696 wrote to memory of 3952	1696	msedge.exe	92
PID 1696 wrote to memory of 4276	1696	msedge.exe	93
PID 1696 wrote to memory of 4276	1696	msedge.exe	93
PID 1696 wrote to memory of 4276	1696	msedge.exe	93
PID 1696 wrote to memory of 1748	1696	msedge.exe	94
PID 1696 wrote to memory of 1748	1696	msedge.exe	94
PID 1696 wrote to memory of 1748	1696	msedge.exe	94
PID 1696 wrote to memory of 3328	1696	msedge.exe	95
PID 1696 wrote to memory of 3328	1696	msedge.exe	95
PID 1696 wrote to memory of 3328	1696	msedge.exe	95
PID 1696 wrote to memory of 556	1696	msedge.exe	98
PID 1696 wrote to memory of 3516	1696	msedge.exe	99
PID 1696 wrote to memory of 556	1696	msedge.exe	98
PID 1696 wrote to memory of 3516	1696	msedge.exe	99
PID 1696 wrote to memory of 3360	1696	msedge.exe	100
PID 1696 wrote to memory of 3360	1696	msedge.exe	100
PID 1696 wrote to memory of 3360	1696	msedge.exe	100
PID 1696 wrote to memory of 1560	1696	msedge.exe	102
PID 1696 wrote to memory of 436	1696	msedge.exe	104
PID 1696 wrote to memory of 436	1696	msedge.exe	104
PID 1696 wrote to memory of 436	1696	msedge.exe	104
PID 1696 wrote to memory of 2420	1696	msedge.exe	109
PID 1696 wrote to memory of 2420	1696	msedge.exe	109
PID 1696 wrote to memory of 2420	1696	msedge.exe	109
PID 1696 wrote to memory of 3916	1696	msedge.exe	115
PID 1696 wrote to memory of 3916	1696	msedge.exe	115
PID 1696 wrote to memory of 3916	1696	msedge.exe	115
PID 1696 wrote to memory of 1908	1696	msedge.exe	118
PID 1696 wrote to memory of 1908	1696	msedge.exe	118
PID 1696 wrote to memory of 1908	1696	msedge.exe	118
PID 1696 wrote to memory of 4884	1696	msedge.exe	119
PID 1696 wrote to memory of 2044	1696	msedge.exe	120
PID 1696 wrote to memory of 440	1696	msedge.exe	121
PID 1696 wrote to memory of 4976	1696	msedge.exe	122
PID 1696 wrote to memory of 4976	1696	msedge.exe	122
PID 1696 wrote to memory of 4592	1696	msedge.exe	123
PID 1696 wrote to memory of 4592	1696	msedge.exe	123
PID 1696 wrote to memory of 4592	1696	msedge.exe	123
PID 1696 wrote to memory of 4736	1696	msedge.exe	125
PID 1696 wrote to memory of 2160	1696	msedge.exe	126
PID 1696 wrote to memory of 2160	1696	msedge.exe	126
PID 1696 wrote to memory of 2160	1696	msedge.exe	126
PID 1696 wrote to memory of 3040	1696	msedge.exe	127
PID 3608 wrote to memory of 4644	3608	msiexec.exe	131
PID 1696 wrote to memory of 440	1696	msedge.exe	133
PID 4644 wrote to memory of 4220	4644	MsiExec.exe	136
PID 3040 wrote to memory of 1912	3040	UrbanVPN.exe	137
PID 1912 wrote to memory of 3616	1912	VC_redist.x64.exe	138
PID 3616 wrote to memory of 1148	3616	VC_redist.x64.exe	139
PID 4304 wrote to memory of 3436	4304	VC_redist.x64.exe	149
PID 3436 wrote to memory of 3048	3436	VC_redist.x64.exe	150
PID 1148 wrote to memory of 2064	1148	VC_redist.x64.exe	151
PID 2064 wrote to memory of 4264	2064	VC_redist.x64.exe	152
PID 4264 wrote to memory of 2864	4264	VC_redist.x64.exe	153
PID 3040 wrote to memory of 3704	3040	UrbanVPN.exe	154

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.urban-vpn.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffff807c188,0x7ffff807c194,0x7ffff807c1a0
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,7391438810373336305,12414850960332643685,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,8888685197918547954,16738930544267623130,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,2423131274032447012,15796908921164583352,262144 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,3103114931765159198,15053259853534929835,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,7185041613988584186,16746707547019990156,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,156578560434106826,8417382792708786308,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,8123892578637287006,11920557252588428983,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,9826533625194957317,2930678298514442547,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,5029127755011714308,6791593832468686628,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4068,i,3147416951526467990,17377068721590609882,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,11220776559002424265,1452105095384862920,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,11220776559002424265,1452105095384862920,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6668,i,10107652485975137304,16856665441195242477,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:2
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4404,i,2878387848748990032,2090126451441373526,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:2
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5968,i,5640666010743400579,7980329067927482532,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5632,i,2841210479722643398,723665568670861624,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,6864973665149886531,17551051046936640502,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,32133105686753419,11812025765776333706,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,14335079177402100618,16742978038821126534,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,17159737236285700182,10818260526749229610,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6576,i,17165183581651232952,7250637024042089850,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,4097093501255861565,13935708421922403820,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3616,i,1271326521605566925,16933429563425985052,2097152 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:1
  2⤵
  PID:2160
- C:\Users\Admin\Downloads\UrbanVPN.exe
  "C:\Users\Admin\Downloads\UrbanVPN.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe
    "C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe" /q /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\Temp\{9D6E001C-4A67-4CDE-B75F-D1C7506842CB}\.cr\VC_redist.x64.exe
      "C:\Windows\Temp\{9D6E001C-4A67-4CDE-B75F-D1C7506842CB}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe" -burn.filehandle.attached=580 -burn.filehandle.self=576 /q /norestart
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Windows\Temp\{D9D795E2-D191-46B9-917C-1F81D3E8B60D}\.be\VC_redist.x64.exe
        
        "C:\Windows\Temp\{D9D795E2-D191-46B9-917C-1F81D3E8B60D}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{FDB7F5CB-DA48-4B05-A98E-C6A14507CFA0} {75E1560F-3055-44D7-9E0F-DC23259BF5C3} 3616
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1148
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1104 -burn.embedded BurnPipe.{ECA92C78-30C8-45D0-B12E-7FCE8C41E0EA} {3B79D90A-4B94-4225-B90E-6A4317843272} 1148
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=544 -burn.filehandle.self=564 -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1104 -burn.embedded BurnPipe.{ECA92C78-30C8-45D0-B12E-7FCE8C41E0EA} {3B79D90A-4B94-4225-B90E-6A4317843272} 1148
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{26EC2D55-034D-462C-87C0-1B54C4FE7E05} {F2807141-3279-4095-B87E-392D08CC9FFA} 4264
        8⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:2864
- - C:\Users\Admin\Downloads\UrbanVPN.exe
    "C:\Users\Admin\Downloads\UrbanVPN.exe" /i "C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN 5.2.1.8262\install\CBCB962\UrbanVPN.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\UrbanVPN" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UrbanVPN" SECONDSEQUENCE="1" CLIENTPROCESSID="3040" AI_MORE_CMD_LINE=1
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,14401569094438154495,8711048055219406703,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,14401569094438154495,8711048055219406703,524288 --field-trial-handle=2356,i,9620605299476857325,14291836909811028911,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B7E38C1FA7822C045A43DDB9F5D23D3C C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Users\Admin\Downloads\UrbanVPN.exe
    "C:\Users\Admin\Downloads\UrbanVPN.exe" /groupsextract:100; /out:"C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites" /callbackid:4644
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4220
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 02307C599DADBABA6BFA6B60581704D9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2344
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 4441AF7A78DBB73AF939A025963359C0
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Checks for VirtualBox DLLs, possible anti-VM trick
  PID:3692
- C:\Windows\Installer\MSI8C74.tmp
  "C:\Windows\Installer\MSI8C74.tmp" https://www.urban-vpn.com/install-desk/
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.urban-vpn.com/install-desk/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2a0,0x2ec,0x7ffff807c188,0x7ffff807c194,0x7ffff807c1a0
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,11056604050665266358,15086528684435630287,524288 --field-trial-handle=2356,i,13300887463889535606,3420399658128947346,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
      4⤵
      System Time Discovery
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,18230378931294991703,16353821827293242893,262144 --field-trial-handle=2356,i,13300887463889535606,3420399658128947346,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,15500188563511805667,3257938769640963549,524288 --field-trial-handle=2356,i,13300887463889535606,3420399658128947346,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,5543233800188542677,2115159090078582522,2097152 --field-trial-handle=2356,i,13300887463889535606,3420399658128947346,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,10907872598626877265,18080013817597094089,2097152 --field-trial-handle=2356,i,13300887463889535606,3420399658128947346,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,15525526813262314569,7900760581430005688,524288 --field-trial-handle=2356,i,13300887463889535606,3420399658128947346,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,4347489256768295064,10113537925662863163,524288 --field-trial-handle=2356,i,13300887463889535606,3420399658128947346,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      PID:5616
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffff807c188,0x7ffff807c194,0x7ffff807c1a0
        5⤵
        
        PID:5704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,13195023327475443200,1224362397959684281,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:6000
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,2922154828184727777,5335936416367223727,262144 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
        5⤵
        
        PID:6016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,640542614020698385,6318072033770501353,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:8
        5⤵
        
        PID:6024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,6310540739552806773,5676688094249909052,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
        5⤵
        
        PID:1600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,7605010373993307163,7077689898227277085,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
        5⤵
        
        PID:1108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,7605010373993307163,7077689898227277085,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
        5⤵
        
        PID:464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,16992009930461067977,15773539483727951830,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
        5⤵
        
        PID:1832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,4730108298779636551,13929805049938037926,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:8
        5⤵
        
        PID:2144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,4019245135152483323,8463492827570595197,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
        5⤵
        
        PID:3280
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,15153382435465750567,2526190048486865407,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
        5⤵
        
        PID:5936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,4318041807085548979,2500257913402429174,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
        5⤵
        
        PID:5676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,14803268603061657975,1532014181733620121,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
        5⤵
        
        PID:5624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9924370272902852648,382184569120182579,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:8
        5⤵
        
        PID:3420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,15737456349536285328,3557353217587551676,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
        5⤵
        
        PID:4636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,3748183275043510298,15165260266495981506,524288 --field-trial-handle=2548,i,10609782747547255534,7743344693584766795,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
        5⤵
        
        PID:1656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 00C841DE28636A57AA0CB83771D88788 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4960
- C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
  "C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /configservice -name "UrbanVPN-Updater"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:368

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:2060

C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304
- C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260709153653.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.filehandle.attached=520 -burn.filehandle.self=540 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260709153653.log"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3048
  - - C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{9A7FAE71-F917-4E92-AF2F-3EC3DCE159D7} {FED838FA-C9D8-4923-B99D-35C795568942} 3048
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1716

C:\Program Files\UrbanVPN\bin\urban-vpn-service.exe
"C:\Program Files\UrbanVPN\bin\urban-vpn-service.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:5160

C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
"C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /checknow -minuseractions -restartapp "C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe" -restartappcmd "--tray-minimized"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5684
- C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe
  "C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe" --tray-minimized
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1708

C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
"C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /runservice
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5228

C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
"C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /checknow -minuseractions -restartapp "C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4956
- C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe
  "C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: AddClipboardFormatListener
  PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:2832
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Windows\TEMP\{58e2afc0-0a27-044c-97fa-4e311e03cfdd}\ovpn-dco.inf" "9" "442c7d997" "0000000000000144" "Service-0x0-3e7$\Default" "0000000000000158" "208" "C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\win10"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5988
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "1" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:c695c3de07ba2b5d:ovpn-dco_Device:2.8.2.0:ovpn-dco," "42b53aaff" "0000000000000144"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59533c.rbs

Path C:\Config.Msi\e59533c.rbs
Size 19KB
SHA256 fe638f166395ccdafeec1ae1d548428b005786c24ff195170ddc219765f56278
MD5 1554b88707ffa094fb04237530b78da1
SHA1 24b8622fd8d8cdbed719aff9156f8ddb9c511e72
SHA512 3ffa08d481ab29449b3bd13227004f5838bee8fed2cd50b2d9929e98b513484f326a2d805fa68e4945e2377fc76ef954f6e8332e4e6ec86022684173d8ba1f6d
SSDEEP 192:bMRW1kR815dXcFUADIc1L+W+y4+agPu837:bMRW6R8TeC81L/c437
TLSH
T18C92EB42A680C9D2D8766B30CD675FA53B76DBD5A390438B50DC90308F93BCA2F9D68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e595348.rbs

Path C:\Config.Msi\e595348.rbs
Size 19KB
SHA256 cd7c512f347c25619da2cbe6dcb50e747bfe698f9703b430b064cc9b3987a8cf
MD5 879d3801080de03af6b451bb77277807
SHA1 47ce3785a3a72fab25b1b2f2120c96043ac23c16
SHA512 c7789f60f2d6b69f4cb851f049ceb0321ba7b8586cf02c5626349567d4bfb235f14889d5b7a8ccaff940fd3797af173723f0b4c11d280277de58afcf43580ca2
SSDEEP 192:bcXDiX1XMcXMEXMdXMHXMNXM6XM+YXMXXMJXMyXMnXMMXMPXM7XMhXcXlX2YXV67:bSXv28mpaMSxcHUQxRGRGDL
TLSH
T1DD92FC42AA40C6C3D8A62F30DD572F2A3775D3EA9760935B01DDD1348F837C66E8D68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59534f.rbs

Path C:\Config.Msi\e59534f.rbs
Size 21KB
SHA256 2724a640a7a4d6cdeeedcdb3578aed71ec75351b2544d64963074d77b405385a
MD5 aac10870811baf60be31a20ed27e4987
SHA1 b6ed650d1f098e8d17555691dd37204d38cc362c
SHA512 e3216fb6d28d905b374795501ef2d625bac613c2bd9ab7a693162b32ea60203d08e5bc5378319ba1be15fb5f9dd523cf673e4220d0c1a74733cdd1e619b055ff
SSDEEP 384:iWRTPGR1nAKxNAUhUC7xJjrMNYPVIbS/Y2ud8EjM7wJLkP:iWTeJAKhCsL
TLSH
T193A20E03768099E3D8622BB1DD671BA53B73D7D99350434B10ACD1388F633C72F5AA9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59535e.rbs

Path C:\Config.Msi\e59535e.rbs
Size 21KB
SHA256 9a627dbe810085c2023b980d58d0c455b9a202c84877fc1873f6248cbad9e88d
MD5 790a4c5f611b60368214d9cba71d2f54
SHA1 ec5a2a800c71788240f90ee2e36fcaabbdd2d66e
SHA512 3f91842304e629bbf75b7f7da98facf56bd8900c35c5f15af4874a735242d1ea700d6bbb63679b81f4af868023c9337f9c6dfc6c84632d912d4d869f82ac7065
SSDEEP 384:iNrQoNFcB1np12gju4aD9WsalckU72eC6ob/prqrJof4Nn5:iNrQoNFcB1np12gSLD9Ibh+NofUn5
TLSH
T1C9A20001AA44D593D8A62B70CD9747A537B6D3D9D7A1838B12CDC2304F933C71FAEA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e595361.rbs

Path C:\Config.Msi\e595361.rbs
Size 383KB
SHA256 c8fe8ffa3126098e20e10573b2915b834626cf8691752087f9037eab4408f708
MD5 f87657f64804b770e9be58193e1f4bb5
SHA1 59121e4371362a35380a3c92dcfd5b05e0600d44
SHA512 97f5d1a47d74e60fd64cd1f97bfb5b4407c0824bf8bab6920340f9af829ebf8b53a6bed5e3b775fb5d4ac1424f928277da37d14106f787f193700b4ff3ea4cbb
SSDEEP 6144:LsbvBbhOr4+T1lqK0rklph0lhSMXlBXBW/+BOmrR:Lsbhwtl6klph0lhSMXle+Ec
TLSH
T15B84BF10D911C0B2E22F2A70A769EECF5F2D9E508B5095DF73DC8D368CB1AC11B3965A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Urban Vpn Updater.exe

Path C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
Size 1.8MB
SHA256 462fd57639aa8f45c938df603bf94717a1c81e3c4356f515201618b789d52c12
MD5 cd920f0a49d0cab5433c88da9f0f7d9d
SHA1 8ab405b231e25495da978dc107df78fe1ef4526f
SHA512 51bd2180cf3d0c6d85bc9ee5d2c55f8f2546cfbc33cb1ac0490e3be5b331f454b445229caa39bfc6f72b716ebbd8516587ab8daaecb6856ad14f10dee86952e7
SSDEEP 49152:tJ1O7EpfelenkVglN5suzIEUP7ZmQNRB6XG+ChS9GBaaaa8arab7aa7aacPcvGqG:tSVqkVglN5yh+mpaaaa8arab7aa7aacj
TLSH
T1E9857E71369BC43BC47E40B06539FDAF953E6D269F5898C3A3C87D2D1A744C21632B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updatesNR.aiu

Path C:\ProgramData\UrbanVPN\updates\updatesNR.aiu
Size 2KB
SHA256 2afcb6bf962f1cad2aead8466200f8e9d52963de828d4496766094d7a0f1f9c7
MD5 b9b828a894c5b31e32717e006192a955
SHA1 f5dcad1e2a6f879d3400dd2bf3305d670472cb85
SHA512 16296c3c8d12ae09d7aa983d1e1c56dc72465e0b38520f8c78ac117adda80f8a0b52d1d8f96b52e82e762e4cfd34acec8bc97a8f0875d42e891028aa0e1b4d2b
TLSH
T1245131D7E20157DE8A5B27D943191282AFBF62BC7B4448845123C1243301D6AE7EE7FA
MD5 SHA1 SHA512 TLSH

Submit Download

tracking.ini

Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\632040a71cb8de62c9f15f5a\5.2.1.8262\tracking.ini
Size 84B
SHA256 9ed8f527ef958f66b8b8a9e13f1ea18b70ef4a04b0d013b3ce044c0ae46338ec
MD5 fea575bb73ca7fb3158c7d3f376d7af0
SHA1 5d1d9d27cd5d02113fb1b2ffc4316316df16d41a
SHA512 aa387f92a09e0f403c4fb4463c1216f73168a483ff6459704a442362f7e098c0dca0e36de9fdc6d99802e82d708b94f55fc2b06d7e3205c85280617bc6682e08
TLSH
T161A012354D02307444A01205004640500E3026803137603051DF8184E702F54974E808
MD5 SHA1 SHA512 TLSH

Submit Download

{4A58483F-EEE4-490F-8009-0D5ED4E73EDB}.session

Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\632040a71cb8de62c9f15f5a\5.2.1.8262\{4A58483F-EEE4-490F-8009-0D5ED4E73EDB}.session
Size 13KB
SHA256 c8a2026890a48b5e61a29ec10d249e6f8c9aba6189a56c94601ee98dd78925a2
MD5 12e387edd469a9a350f6fa2395c7b771
SHA1 adc2bcca3ae1c276dc2a5c046eacc5b3a95ff313
SHA512 9dc7e508c51f6cb27e02f5fb75bc41ba7aac3c895adee429b52f6531678a2acf9f782c8d5964b3210b5d2907cfbf9ebe4acc2a51f47c1caece0cab8ea3eee030
SSDEEP 384:1GIqz6qz6qz4O0qz/qzsqz0qz4ZqzJQqzLqzSqzxNqzeWqzWgqzbeqzHqzjQqzY5:1GIe6e6e4O0e/ese0eqe6eLeSexNeeWN
TLSH
T11452B62A76FC9212E2B6E640DFE59432A76778596C385E2D51C2030D63D2D037893BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 834e92ddaa17a7b2cd91869f0db964b3025242c42d4408aaa7824498200b0dc1
MD5 335f3c417e54cfdc8ba403bdac6876bd
SHA1 df59715e8e40bbdd0dd244821add484af4c202d4
SHA512 bd0b0a53084632ce5c3e7debb3f270860034a5a6aa490e81bb4fd4d558595da0b2b957bd8f2c255aa8b1b220dcc66db06d49c82433101e54c2d6f0a914223b11
TLSH
T173D023707B346C4BC31734F07511C7427773A357311AD5716160400E5DB81D157CF052
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e59c01c7e383650c9cf136d4a3470ac1e07ca1a5c088494904eccb69106db05
MD5 e950b2e4f31244b3952759bf95cd31e7
SHA1 567e5fc22677b14485d165d53d95a5e71c571518
SHA512 38048f99e44e1b47e34566369c01ba0587216ed21ed4c135487b3ae52fc5695019e2d0ae0187cdbfd46eb1e1afdc73e5dcd883b1688b2b4b9b8dde30a09aa909
TLSH
T103D0A7707A346C4BC21734B0B520C6427762A297211AD5716160400E4DB81D156CF052
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f0682d8e605e123667ee0a06b4b412c8932f61f06880d2b80056a5c3808fd6c
MD5 c16d8cc85245fa70263392992309dca7
SHA1 1c04486b2734f5e5dea6c75e32c5b84453d215ae
SHA512 76d41a0909e8ceee8463827ce19599e16aea10bd9bba63361004ed624a81ae8475c2f266decb8c286dd3fd2171d0aad540a57d4a797a6c7e1da2e30248f101fd
TLSH
T1A4D023307A34BDDBD13930F5A4314B017636516332179765B150840E8D7C0C2B7C75A2
MD5 SHA1 SHA512 TLSH

Submit Download

83c951e6-d2e6-436d-8353-3c1c4fe569e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83c951e6-d2e6-436d-8353-3c1c4fe569e4.tmp
Size 414B
SHA256 291e459a2b358f74824bd5a03fc6551578469d19d62485c4a2bda1066ba8cd85
MD5 fb1be1a5839acbef6fd2d2e8fb2f7f7e
SHA1 6e2df3d4b5fb857aa936244f1dfbadd089f69277
SHA512 322630aeec796ddc9a6eb9a10edb92d6a6c5d0901a2819950b24cfd995248264a83f412f59f6abe19e0880f2c4bf1906843d949cd6535e9e198bbd8bd881687f
TLSH
T1F5E061BAC861DD2729FD076960694B47F76513572740891F3F3CD20C9FB057A4185C6C
MD5 SHA1 SHA512 TLSH

Submit Download

89423d88-4bb0-4633-8ff7-b6a8f5ff0dfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89423d88-4bb0-4633-8ff7-b6a8f5ff0dfa.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 27KB
SHA256 cdf96129361ee17c89a94bef92f1e09508600b27a99f431a50c36d062b1f44d3
MD5 a86909853475e2b5c0b0fc40f23c9b74
SHA1 b528daf26698d8f15e0543ce99a80ab7f613af9e
SHA512 909020a3092e6ec5f9d3b7dab50e1f739dd6d204290f47e59ed85010806b86ae5c6e0ae4b7d020cb1e16764a8642d76ffaa9ae0de142717b59462a9540c03706
SSDEEP 768:yGj2IsqwjCuyMgr+pyo8rqkFqJXfT/mdoQyIv:Xj2z99rga8qtTAy2
TLSH
T1C3C2E1419E67BBE50F7B89339E0C0E767A9BEBC14089DB99D4E2DC1E037C2190E854D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 21KB
SHA256 5fab6157cf89f3665e817d7999b300a89ea4215831e3719556d2f2d39455f131
MD5 4828c49975b26c69e78c0fbc882c0427
SHA1 abfcc602fee62f23bbf11930416cb4aa31a3f755
SHA512 25c0109e35eb132510a040313a47c623132a17d43db5aa3646e54bc175a82064f3474ab27c10bf2917b71cb3514284d1ccff369ddb26e253884c481c33089ce8
SSDEEP 384:Q7b/bgBXKzvQ/AX0rsBD+BmXzVK2MpQTeOImVVy586wGrFf/WjcvcKX81Fn:QfkdKLe2rXzVK3IGZGcEK8R
TLSH
T1A2A2D15D8B6C7306E119C0C856306E5E4651F166DFBE1BCD03E6B98E40F2C67A2E26E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 225KB
SHA256 f4483ac8e67faddec1ff78b64ddb5975b3ff4667691837198778fb96bc725f38
MD5 845842ae0cea34d232c00f81f16b46bd
SHA1 d4510d2fdb61c06777d24525726e5c9f54af6cb6
SHA512 3fbe3b0ba803eca74d68d387a2bd242fa0bf933e90e3ace6a4855fd5024b9cf159cd8b0cfcfee43232067e2af2182b8f0a6094fb81a4550686d3e04c6ee4a983
SSDEEP 6144:Z+r4sPKcOsgsvJ8B8Y3bHedSJNAKTLGYTstPEgJbE91I7Lt:ZZsPKcFx8B8YrMSJNZnitcPkLt
TLSH
T1D13423DD154405E82637B489BFA08F3595A430A6773D342DB3AA9F4F1ABBE14072F721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 17KB
SHA256 b2255f26bbf9a01179fe05da3e94da26a6fcc0f08d77f4891625728ffb182db7
MD5 85ec3d7a681db4858e83ad4a773d61f1
SHA1 490eaab27a3f8b48ffe6e4c203e62baae0150c1c
SHA512 a1aba63f1b0129eb4c7684e44496493492efc30110941f87a84f091433d3b54eed03f829329c9dda4c1b6b6dde097cdab64608ffb47b7cde1bb869265d0bbabe
SSDEEP 384:hgQ5P2mAPHru9xj4yleXXlMLRrKeHdx7us6Vea2R0BE55ua:hImAPHruTj4YLR/x7uTVea2d55d
TLSH
T10782D03DBEDC6308572A34039F7EB2A65896E1535934083C6B97B6600A67FDCD8B920D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 17KB
SHA256 ee378b3053968cd27c773e9a885124578b6dac42332df341b8c5e2d4fecffdd5
MD5 071cd821e94f9e9e5c28e6b09d7b927f
SHA1 5e421ae74e62d98a0c846d181d18ddface96256c
SHA512 fa0a379774f1a6b7b55fc535efb0e10de12a8aea60657672389da1e969e62922ce60c16580ffc331841ebe994c2ffbe2f7d8c96f5a4e5066228b52fc55655c13
SSDEEP 384:GjEtqkOh0yLGCrIG9N74c550oFB95lIdapNNm82KEYIB:GsqkWbL5j74IWsigiKEY2
TLSH
T1FF72E1364E30614F4D082E93FF095011B1AFD321FB8A50EFA5CA47E9279757B4AEAB44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 40KB
SHA256 f34011ad247a0c617325acf0139fe207115beb7bde180c9e6b490a480b065aea
MD5 3959061f88978b44658644dd85958560
SHA1 17022c6b6b96f632996262ab71679fbeaefa6e9b
SHA512 fd4e626e3132b625d0893734cdce238fad36b483b0a576668ce7c4b05cc8afeac8d3919d1389f068de17fceb6eb2484819ae6df634cdfbe42a23f39b4b8869c6
SSDEEP 768:s6k0z4XQCQEpsQOMKgbX1NnyJ2CvyyFUzr24VAqutkGHziw:s6k0z4XpQnQO7gbXnnycvrEFOw
TLSH
T13403F18ABF232A054DC770271116655A69A334B29E343BCB95C2B62B94F311ECF116B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 62KB
SHA256 3e529855b63a639a30ff0bdccf6b21427ce03fdb6bc63a00d1a7eb41b8ee7f25
MD5 19950a5a00791a0ea79ea6495150dea3
SHA1 22e77b0bc682d6dcb2a0372cb005e948577b913d
SHA512 cd695e8adaf5e126822c453d069c0c197e6ddcbaf46413baea3df55fddbc366ed68bd66465110adf76a7efb668a55165fcc40075c17c7c91dc451c7089f54f91
SSDEEP 1536:VqNjDiWUaSdFeylqRldrMHKX3vaX0XTT+wWlw/o:yaWU3FZKYqOqT+xlw/o
TLSH
T19D530140F555437233A1D16596C1B1AF76E32FB2F6CBA0B9091A41EDB18EBF109A4CBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 45KB
SHA256 b3893db3ba9ea2c204f61aaa0c947242788d1d672de6e7307a69e2b40428ecfe
MD5 aa9c39340ce1984c1d43f15f4f7e2515
SHA1 c231c81afae86daa0f25c67d051518a610fa57cf
SHA512 470e7974880ee8ae74cdb9d6c7c5b7e66fb1e401bebed84caf4bb1d6396e209387074d086c5d8494ba91dcc20796bf81a9f0333440922aab60f7b8bac412eebd
SSDEEP 768:gl2xXqUwohXYe2TYLhrM9jBhQaV+/8ibKQHLPeLQeIj3A4uw7M5u3K24/jheHTLN:UsXDYevLhA9jkob5SbzLuw7CuS7gITpo
TLSH
T15923F105E3DF887A792BEE452A03E014ABEFFC51935B00AD620AF01CDD6B645BF2D055
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 48KB
SHA256 48e33b26e97e11caa388c07740b958871d8907135f1acf37d93d55339effd38d
MD5 b4a8b7fe02d37c26e5843791df5f0e81
SHA1 f63c66b9347afc4644162071672d7579239a9f6c
SHA512 db3f710d977c8699c8991948809ef593cb8e62e69acb1d485a76dec13ab5163e2082a157a8661ed7e1dbf442807b3149eff512544b16b0bcee719c7d3fad129e
SSDEEP 1536:3Q8o1HmLk5IKxQ4Dvz7SuUw/SV3mrs1Cuj3Q:aGL2RzRm3mrs1s
TLSH
T18E2302A577B69B420880840A170C52FD39F74EA6AC7B3519125C573FB81CD7B8DA0A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 74KB
SHA256 ae1bdf3c0ef1d84ab5260dbb0b90ad441fd944065af34d6af57115f923366093
MD5 78b2a22a4147d151a5ee9533832315df
SHA1 2b40c68410b56d348586181d65ee2e03c9c791d3
SHA512 167496e90606f0e1a3a406db8f56cedbde7cde86d7c741d43850d9b08410146ec8d36d4f51016376c507045ea2e4112d5e77645307292ff49634a470d28c1e5d
SSDEEP 1536:lkYnK1wFbS/wfS67iHm/dUfEP4xvLjoo/qXFFK63qSwzaezzupQ:l5GwowfzldUfEP4xvLtcHRaFaez6pQ
TLSH
T178731252E32F704C6A2164640D4B6F769826F87736C56D4BAC5D8EAEA7D0E304218FCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 107KB
SHA256 c1f4e17d3a883a847a441058cd89d00943969289a806709cd4311d8c3244a642
MD5 659a27b02dc224baed86c3ec752686f8
SHA1 7b25aac03267086143fde0d8b6b2d0439bf7c44b
SHA512 ca673c3cdfe867b99dc3feeceef4e1088429661b4242d521d29e7152bb2c634d5618ddbeb1e6aec26b32a247737df5da073bc8a51b6078146e6f3f920ed3e26f
SSDEEP 3072:azGU46IB5eiQ62WV0Bpd3xjIVsyBDdDg6f9MOetW:HUe5eiQ0WBBUVsyBDdZVMZtW
TLSH
T143B3124F6CC5C4CAF0EC5E84A01C033299E9405A111AE6690FB7CA70FD99BA9BBD774C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 20KB
SHA256 289d0af6e6f661da711511e455658f9cdb94acfe0db81b28f71e6f309ac0c6a5
MD5 91feac0a41f786f30a70a81b0b0943ed
SHA1 3612fdcc5ff9808ad7bb076317c214a79ee89255
SHA512 d9dc06aa824d38ad0a7dcb36aa30ffb7d88fc0a45a4c0f1221d1d18b84a5fb09f6c63e9eb7a760ccb433ed6d746c20ab178c35f959fc9e20ab047b8ef38d8da0
SSDEEP 384:V6nnFhCth0BM4kGDT+0JUsSQ8e9fUU7SrEuMYaGjoih9V6fJWBPGx1a+Kk9C/9U:V6nnHJl8etUu/uMYaGjoi/IwyX9Uy
TLSH
T1E192D0D9099F2835C45BA47DDF76AB263661900DA39C4853BE5E3382B0457B30B98FA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 40KB
SHA256 0d92bec3b944b1ccf96e31b432a6dcfeade3349225b31933f7a03e66fc4d3289
MD5 c9eadba88daf114e480efbe3cfec3c64
SHA1 3db6594b31d9856e475d64fb85f699d03291ee24
SHA512 59924f6b6d5f99a38c2590b018bdd4b85e1ee51916bf95138b45088e2d7f576b60ce385f1693a95666538967aa727bcce8609ac05046e04348b9e4d441381654
SSDEEP 768:r16dgP4kAgc5LdcqTldJ7b/gUNLYa/l4abWpdObC3GOHfdWxwd:r1lP4kAgEJcqTBDLsa4YbC2OHgxwd
TLSH
T10403F1152AD430ADDF3EC146BD468E0468BCA0FBAAD5FBDE16F483C0D94176452B17C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 130KB
SHA256 af46824fed3a6f2aafc4e4dc2256c2235953b63dd1b7b23e52bcabb0eb614b69
MD5 323b4870fa5a35eab75d685f2365c2f7
SHA1 985a468c5d532cec58ecf74f6293f436352c0987
SHA512 e3dbb38657379e3de50125e2feb8eded8b3300bd5ea30a3ad96057a8655fc877b185eeb6152cf78de5def5d22ee20db235db2e4ebae69f87679e5dc857e87589
SSDEEP 3072:wtpu8A9Cuxg0UaCdaNJYdbPnBpv8FTcTiogP4LTlA0JB:wK8OxjZCdaNJYdbPWAM4aEB
TLSH
T19BD312936BBBCCF77B0476F0FA0F11A0560E57F01949D2AA4AA29B7D749CF40CE64089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 277KB
SHA256 fffdae14e4a2069965e70692b96604ad5d21538909385b2abe55c2a6974d3336
MD5 ce652fa0b4be29f35baffdbd972d282f
SHA1 0045f03a54529eb75ca1be477076f5613e7650e3
SHA512 1e7117e865e9d33bb0bad7c04bb009f5fa109a093d2df1d1dd969fb41a0e31514afb5c5e01bb679d71cc6cd426bacaa538cc081e9f544383ce807660bb4154d4
SSDEEP 6144:PvSlPvtEIJuopV9WzgP80d77NjIZ3IZt0wS+1TF8IZKF+Q9:PvSlPeIJuAG0d77NjIZ3IZt0Zce3F+I
TLSH
T15F546DBFF7C8306D02071347B945B739B62D0639B2A1D5C6A888E53E11D1FD5C42ABBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 99KB
SHA256 01d8780b92ef10130f2d98109effd7be90d0d6d06e332eb24e3a6d160ce4cb6e
MD5 aebe9db7ffd0a3ccc2fea50896a08e83
SHA1 e49528cf12070db57bbdb2332cd5bafbc198f8fc
SHA512 e8984607b595589bb7eeb9dcb78b807badf4ac30f7f63282395f865fc2dbdc93ec5984001bf3dff3b01444cbf41f5c71f2ef2bf88cb4e753f078fc5a356495e1
SSDEEP 3072:WJJNi4buU3dQKVXAw8TXoeeufB+luV5zLJFtuit:+iUKKVe4eTp+uVjKit
TLSH
T1BDA38D178C08DB53E86897F8BF031E6C5B5A2B1CE59137FE14621EDB7E602561D8A03E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 d7e3206c85c7d8f2805a001fdf8c0728ec563f7e30bfb4379b1677976a889ba3
MD5 820b35ac9e4c3d936dcaa34dc8443686
SHA1 b14a807f5f98050053a410cfbaf6443dcb4bf5db
SHA512 04619773854dd36ff8d35b11f9c6565fdbf0e8a2570fe37451578de26ad109f6103e90baad9061ae2e4a186fc4dbcb32ff505b60c7f78e7f2957ca8d26f19699
SSDEEP 96:Vr5C05Z4/lRIRPg1NdRZpt779kAm8tJQIG09:tZelRkPWzT77nttJQIT9
TLSH
T193B1FA76AEF0849DDB6F093146F619A272B0F4DBFA471F1F8988B4B84412BD4CD1A41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 df33df59b3eecedceaf018adc82d3800dd0bdc5256663cb861c8709adb53ea04
MD5 bccfb273620cf3ab1fe56443d3a32de7
SHA1 fc005782ef26af26cc9a93ddef7f2e60ae72549d
SHA512 a3b23f0e57c560bfda5d361bf09a3be78012057d371233182dda776b20e8e4b4993f7ec9415c013bfadb4e6f39369a9ed1dc8f7e50abe4e21abe671784c8f3ad
TLSH
T17C616F773D3545A2E3AF067094E12AD23035F4DBFA4B2E4E1588B9F55524FE0CE5A808
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 ef4f58ab92d2a6b167acce988dc24de396dd08f9a1e21dc628e11ddfbe4f00e4
MD5 c78882dafde594b4a9bfaa9cc7d46003
SHA1 25a63a9093c2f4b57c8b05cada62ee99acc6260d
SHA512 de7b3f57610fd0ffd76893b3d0b2255c464d74e3299a4e813ab54c1fcc47328f6fa4b35fa234156ea94004db5aa2907f1569dd2f7f8bd397089cedfa80e0653b
SSDEEP 48:QHDmEmJkDs58vWl8APomNtsrVYk1fWKEuWORcvNhBv3SbIqOmT8KMv5W8x1iM6CG:qLdwLtz7PNhYMqFMv5W8x1igX3g6xvG
TLSH
T1A5B1D776AEB0889DDF5F093046F609A232B0F4C7FA471F2F8948B47D4412BE4CD1A419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 37463b92f54c4fd887e365320f813e1d3aa35b6ff127dead15fc3644e35aa183
MD5 2cb9abd22cc7668bd8567a5d8402c758
SHA1 0358cdf46e55565448fa7cc9336e04b911aa3544
SHA512 de399095432cd99e39554afd3389e4917207bd01709afe451e967c2097482d86ba463f69590b9b53ab9a9b6f92354a91bdd48a329b4bfbff57be2029b32794fb
SSDEEP 3:MsEllllkEthXllkl2zEklREt:/M/xT02zn
TLSH
T12D4404447FC10C0FC70310304011C3500370DC7005557743745154535CCF5C00C01040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 bdf9112950ad24cebf2d4661e74638d0206d3498bbb2d9fdb08b43b594bb8301
MD5 bdd7bfbdf9de656ab486569e74215030
SHA1 b9fef223362fc65ba01f2815c3d4a1e299d78b8a
SHA512 a4af53f52607f3f68a16a18b762f0c5f088740ea52b9f5cc51c0e10707102b4f6781f3dde27e97feab74c0a3c16c89d830082d69180ca859858df0742b84ad45
SSDEEP 192:DaX9v7e6lpbLRnCeyA4n1QVRj6TGKf5e06WIVJhmUuQHtakyMwVJ/XrBTiUlZpeb:DaX9v7e6lpbLRnCeyA41QVRGTGKf5e0e
TLSH
T115229CF7C2E6D52DE81259F49B18AD2ADE1C0518431C3D268DD5BF8793D3862E20269F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 398be1c36231b073b83166d7babf1e715d65139cea7a96c27cec93107e7c02d8
MD5 a4d86d6c909c13baa2b22cdcce2d2b6b
SHA1 f1779c4276d02b2ab4eaff85a3972c5fb80c34b8
SHA512 f704b28b7742a45ab57322b83a4663e081111aa504d0c88c1ca10257d93c60d2232391d70bfe6662cca2e79135170d31a7df28434724183b6afb792f2ffe73a3
SSDEEP 192:DaX9v7e6lpbLRnCeyA4n1QV0/BAaj6TGKf5e06WIVJhk+sGew4Q7SKUv1qtbcsuK:DaX9v7e6lpbLRnCeyA41QVIBAaGTGKf4
TLSH
T1BE129BF7C2E6D52DE8125AF49B18AD26CE1C0618431C3D268DE5FF8793D3462E20269F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1b6a96616e6ff8b8278b033f32f614ad94b10fade600488f8daa54ce71e1794a
MD5 fbeee3f82e260a8d07b137c72aaccd11
SHA1 27bb76e5018138ea796b5ab740527beea9854ff8
SHA512 78ea020f05b90abcf0307cf6923de6cc2ff1651f0c2841ebe58adee4cd1abeb743ab06e42aa5aae6a2b4a3138eb07cb961662794f32d071e10eb5074bafa291c
TLSH
T1E0416A93957EE87B203D2D6F0D4978066DBEF432468158F5DA6B836CB0C18BB1F12022
MD5 SHA1 SHA512 TLSH

Submit Download

fc9f9cde-a16c-4967-837b-d49b3373761b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fc9f9cde-a16c-4967-837b-d49b3373761b.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3e5d3a164d347583e35d9ca0ae8d29893a793260aa20deeadc0edd19a6b052b9
MD5 82ae20dcd4b2a7ae60c9181e9ed3d3d1
SHA1 326be362a4125e07de46c1c634cf854638767983
SHA512 35660d7ff86fe9c6581a3785d0107939c610e7bdb9918e3619975c0d1497f2179253053570c6509a85aed18fdd58ee018dadfb5813231913f1f1e1f7eb2c96b1
SSDEEP 192:sxZWRPyM/jK1Ml8Mkw/f9soKzLOhDdpwwQHW6+WN7pP/Y9IFa+VIgrJ:sxZWdMw/f9soKzKpGHb9//9
TLSH
T10052E8126A3499B7CDDBD209FA55BF53D6F9457292901E44AAFCCA0C04E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 01d8a534bbb2a12d0f05a4c4003878a23ca4df94f7b8d2126ef256a90920a7db
MD5 adcbcedf09a4cd04a839ab4dc5448283
SHA1 61365809df9f98910dee339096b68481cb3045ac
SHA512 9daae5c76d85bfaddf9acfe8913b49f2827b6b2146bad038d7d7283c189e95cc529b7aa7ff6ef5b35136c971a90497f258ea756d878330af0493c8efe639643a
SSDEEP 192:sxZWRPyM/jK1hl8+9w/f9ssWpVQLvpwodpwHkHW6+WNx/gW3s/RrIWpKEfOIGx71:sxZW6xw/f9ssWvQLzbHb2ZraNVp
TLSH
T12472C553A5344DBB9DDAD219F945BB63D6F8442392A05E849AFCCE0C01E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f8ce7c5a49b97a0721d20ef9e0383f24ef1f96c16deb469d672719e850914c24
MD5 254381bb0dea4bb6e97e9e66c28fdcee
SHA1 12eda5beebedbd2c69a2a7078cfbcf889d571987
SHA512 384031053a55d83b1e32ced5befa63d9f38e1df98b28e1e338ad45cccb2b99dc987ec554fc8e3f7a919960ed1a4e72c9d731a49d2a223966b2ec07d47e3028bb
SSDEEP 192:sxZWRPyM/jK1Ml8M9w/f9siKzLv8DdpwHLHW6+WNtnZOtXY9I4C+VIg5kJ:sxZWd1w/f9siKzL6gHbBSXO6
TLSH
T19952E812AA3459B7CCDBD209F945BF53D6F9556292901E44AAFCCB0C04E6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c9f9412de1ccca8b8e70d67b082eacfc6acedd71cd82f8bc1bf3606ac7b3947c
MD5 aa392cccc51f4173046f8d546f9ebe17
SHA1 6617ad65e999963a816e91486faef1eee5cc9aaf
SHA512 dd8ac03d971b3017a5937a1183c3ee227813b01704cfefad5606483118221e4fa7a50fed043d3cf382e062bc78bb6aa5b17477cea8a7ad243938169bd6c0b147
SSDEEP 192:sxZWRPyM/jK1Ml8r9w/f9siOWpVGzLvgDdpwHLHW6+WNxsASCRZYDeZAsvWTIgbo:sxZWdUw/f9siOWvGzLWgHbtZo0
TLSH
T13562E85266345DB7CDDBD20CFA55BF53D6F9552292A01E449AFCCA0C00E6BED620381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5d3789ef76cd14c6391be3631c5a436609d0e6c83a02c726a6521e205e295f9d
MD5 739e79d1985053a3fac577e63e8aebf7
SHA1 774767ef58a695a7791c8697346af4a354a20ad3
SHA512 098153a2c7c078c31f7268f51b95405c92a6ba08b48fbf8f44c6f297ff979631d48923763c383c871fe0095dcc126748a358e6840d5cdc98f02172c15fcd4555
SSDEEP 768:vYcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNAro9g6W:vYcv21wWvu+Z+u1jaeFLeRNL9G
TLSH
T159D20B2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 dbbeb62ec5d110e94fd0852866844780bd5b9ba67e67f0d83d54a837336fe153
MD5 7c1f317a280233b05af60f33b6cef173
SHA1 b9a3b33c007ab87ea332d21e2812f1995f70ff4b
SHA512 9b76b2aea395176c162514b1a80c02c9c2d3b9d3921fb64673284de5815705df1fc5534edfc979a871a1e3ce44be93146d83139c52bec3af53c10b869455fb38
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDGPiKwc+iG8KvKauJCKiYiyX+SkE0SWcJhD:mT5RXfdRyX+SkE0tcJCCqXg4ZCqRwSbg
TLSH
T1FED1E006303F0352387D691DA2B6852A8E8572A33814EABF7BB800958F67D525DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 00d10a36c01ca7523468fd05dee1a6a2892bf087f02b49e034de02b23b9dc1da
MD5 0bc8328db6d32e65a57b249a20b90ded
SHA1 21fcba675147a54eacbd27759ceddc23b97963e4
SHA512 09eac6e2a630a43f1aa3b96b070917bdf0ab565b54b01a977f6de844c1a4fa28536ca78ae0ca3f808207428fb5eac5fa68a8b63e805c5df5a07910f72dc56558
SSDEEP 384:nNtNn/s3n9SJ3sN/yPwv7zipgde+C/dHeWS+2KTRGAS5doDlKp/4GHmOObjI9G6C:Nj+9s3MXX8HkJlKTXSkBKp/4GHm29Md
TLSH
T165C26C75E8655CE74892E4C9B647E9177EF81137C6891A0CE2F8BB3E308F9BC5706011
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cd5b395322da7fec7cb2726e62e467f023944adaf6684b1803ed7890dfc28658
MD5 d183c00275aea4c1ce651e4c0c4eca53
SHA1 8a6a414daca983d2aec1a9ab9ecb6a875e95410b
SHA512 1de5bc6846e8f6bb3139d8f043ef71d17b6732570a59645a9931a1f883759115ccad9db9496bbdcc6f16fb95211e69d326a967feec9b84c160a1a59fc32c0282
SSDEEP 384:NtNn/s3n9SosNUyPwv7zix7de+C/dHeWS+2VdyvaASEBtvsQk9lMUtOObjI9G6w8:Nj+9X/XU8HkJlVW9SRZ9me29M4
TLSH
T1DAC26C70E8650DE785A2DDC9B24BE91A2EF8423BC599190CE6F8BB3E319F5FC5311811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8c618b2a2f83122ead304c508e6d0a129efc124cbfee53844c462c28839035c
MD5 0346f8711d188bf11c5537cdfc7f15bc
SHA1 44ceb9248b4c008cff9f70fd9d0e977c73ab0686
SHA512 05da124d5b4af20457898f513de558b2ebb3797bb8ac799a0cb9dc91f09353269a488dd57c1dfe3f553f7eaad9bd185d89de64a87d0816d04baea2c0eaabe4c8
SSDEEP 192:JONv6v+YLNQmiUymfZh+CGx+Fdew9ohXus6FfU6:JONv6vz/rZh+C/dHe5WU6
TLSH
T16702EA35AD381C7B9FB26E45F5873A175FA42177EA952F80D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 cd25b382eba64131ceccac515593c2d18d3c8f02809fd9364474fd3ee7facbd1
MD5 0222823c9f378ecb1634f49299b7f03e
SHA1 8005dd7c60241e69b46e1eb10cff40dff2a3c6bc
SHA512 efe3eb19a3149e2a5d005e4189016c0d0ffa8a292ead2cec7724b581fbacdd12ce95cef0a25455aaac2c46b3a7d82cc61f1f4f321940e0b45458922e32bbc585
SSDEEP 384:5tNn/s3n9SfsNyyPwv7zihxde+C/dHeWS+2VQOObjI9G6w7/w:5j+9URX48HkJlVQ29M4
TLSH
T1D1927D36AC254C278EA39659F04B391B9FF8917BD7C92F80D5ECAF0C02DB6AC5306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2159f585a167ee24fc8b7012c73b46c72d10b37d0ebb75bd02078dccf1a70bb1
MD5 c5d3a11f62cea5e1dbbcb51c32844414
SHA1 e0bcfbeb1d4899397be9263b924b7d2984d9c0dc
SHA512 1e7a6c70cc3b4d0e9356598521b8dbecb474eec0c08c0eea27616aa8ff8834ee8ea068d61218e03313d5130f59e32a2cec5362dab3ef64d71919158baeccbc6c
SSDEEP 384:vtNn/s3n9SfsNynPwv7zih9C2e+C/dHeWS+2VQOObjI9G6w7/w:vj+9U2XsCBHkJlVQ29M4
TLSH
T11F928D36AC254C278EA39659F04B391B9FF891BBD7C52F84D5ECAF0C02DB6AC5305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d57e8c4dc8165d5f74b98f12513bf4c77ea7299257e33083d33d953163d908df
MD5 f5e9deb4ba5abfc4949c7b2ebbb7ed8d
SHA1 67c6e5d50c7e8207b9aca6769855a8f3a34af850
SHA512 58307978ec364ccdbeb8fa0ec78ed16e9a617291d87a52e884d8da1add11eaf7865ecf829734ce5a79412d72fe27ff3e229c149cdc6435dab993b961ff7578e0
SSDEEP 192:nONL6v+YLpQmiUytf7h+CGx+Fdew9oh9aFS+2Z+CH6NqOU6:nONL6vz7m7h+C/dHeWS+2BQU6
TLSH
T17E120936AC285C6B5EE2A955F48735139FA85167EFCA3F80D5EC2F0C01DF6AC2346816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

702715dc-6212-40c6-9a0c-d71f8b6a1224.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\702715dc-6212-40c6-9a0c-d71f8b6a1224.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ffb816a5cbd404f7be1b6e2c3db8c70813cc178919cb7f22a0fe520241379a22
MD5 0c17808bf40e47558687feca815e903c
SHA1 8f64f389b3f4ad98b81570a21c8fb528114b640c
SHA512 bc8046a55e7f25f29b8a2e6ca8111def2e9ddfc9b0f97063209ed14f0c2d9995d6e1b9b4a785b4bccb02c503e5b680db36584d5e85ad9d89f9d7408b00f1d6a4
TLSH
T16041F848BAF90118B3B36F5A9BF6A96E847FB8371F06D49D10110E4F0662B44C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

banner.jpg_1

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3040\banner.jpg_1
Size 17KB
SHA256 6cf8749ec1e8707785d80385943202d4ae23938b685c9a51be20a7b3f5ff7082
MD5 1728b929d3842941cccaf94722bb549e
SHA1 b5c3efc573cc09ea5c28c569cf72675165e2fe43
SHA512 7bd02dbc6e03c6c71dbcbdb31a4bc667ddb3c4f9c0a26918c82624b1a06b4f9e938a96d667957a43b98a65ad230eb02e7f0cd88ff92b583cca4a94a54b14a31d
SSDEEP 384:mZXAlzy2yXbl57FPRvBOfQuBhuII47ozAiX0l5Wxlb:mZX0yLD7FPREhuIRcAv6lb
TLSH
T1DE82D095C352A0E89CD865EF4CF93604E33610D6E622F322CEE2B8C5E76909D319F438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dialog.jpg_1

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3040\dialog.jpg_1
Size 50KB
SHA256 38baa3126fc159e33257caa77cc277993bca5233cd9ff45683ac963e80ddcbdf
MD5 4107146facf250b451d6eb8fedb4371a
SHA1 816223ecc1e3e7db923b975a0d80e05a65f7d6a5
SHA512 44964e7ad0f95adcc75306eb5149e8642c75ba55297e9714e8d109142b79810b9d675877e404de2ebd5f7455d1c684b2b9928e5ad35f992d15a60d8d9582fc4c
SSDEEP 768:ROnAmtqd0Xw49mY7zbVyBFOQs8SWBMvcSjRP98YhBss2Fju063nVt6F/OvZ:ROjtqD4QY7zber4c8RP+uZ2b6Xv6JUZ
TLSH
T1C033BFB5F3DBF359AB0B01AC823EBDB3071298D519E48643246B1E02D268F70719797D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INAF354.tmp

Path C:\Users\Admin\AppData\Local\Temp\INAF354.tmp
Size 1.1MB
SHA256 7d32c3f22aba69ab7c881b54aa40cc92710630d9e49f861eb1535199780b4f52
MD5 948cdfa1cf23767bc780e1352fcdee94
SHA1 45a8371426110ff8e809d5c21e356ea535232872
SHA512 db5289781f56f3ed809ab7993d2e9d8e018d98e8bf74bbf287ed37dcd8102d75ebeb81d5ee537d103ac97a090d3ec4f9944164d03c518d14a89de2de0d3887b9
SSDEEP 24576:UUL/equeyM0i+B7Q3ImKKF+Oh0lhSMXl8Gek9ApQhqAfEEx4D9sF:ieyMlqQtKIOsGr9ApQhqAfEEx4D9sF
TLSH
T1A245F724EC2E8572FE5F11729617772BE06C1DD01B7058DF82A9C8D61D722CBA239F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7C9.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7C9.tmp
Size 334KB
SHA256 3311ac863a98378e1b5ade58c814158f350067c2a96a095eee63ba19b6ef2e22
MD5 67425672440ac762d3dd7c1cd3746c7d
SHA1 3332b4c89cb6ad8acee47904446dd3f8d76130be
SHA512 484c46ab834f8732ca7c0afc77fbce68f5cba1783ec2889e4283fe6ce76b569b06501d47f14ed8aaeaebcd0c480c45bbaed18eccabd64e22f5a1319cc1e31dfc
SSDEEP 6144:DsbvBbhOr4+T1lqK0rklph0lhSMXlBXBW/+BOA:Dsbhwtl6klph0lhSMXle+EA
TLSH
T12E74B020A956C033D65E0E307D6A8FEB9A3D5EA14FA164CF73DC2DB54E702C16739A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF3E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIF3E3.tmp
Size 1019KB
SHA256 15c35c5abf7bab8d1375f5622e31da14fd027ae1046b8a6ddfd74263fa34eda6
MD5 2330ebbe491c6026af5e8853f3692798
SHA1 6c62d81f6c90046714705bec931815a908b760ac
SHA512 81747ead7869f68e499a53537588d35485b5fd2b4505856cd589bca1f7296d971e78f3fd57a1c1d931dfe6c2668888b26eff49a96ecd740ecd1b271eb7058201
SSDEEP 24576:T21SlOwxeXfwNTELVJh0lhSMXl3SG5vHqU4duDfCK:ToS9xeXf7LKnSG5vHqU4duDfCK
TLSH
T114256C203A4AC436F6AE01F2693D9A6BA07F79BA1B7144C753D4BD7A28704C25739F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF722.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIF722.tmp
Size 1.2MB
SHA256 6e7cdab18e1f705c0ea56a565577db0389ece2b5a4e0f31d3063e9103f59fbee
MD5 c9ef0378879c57a38c075bb28b88fcab
SHA1 dd27d17d691ffddaadd8bd6de532bc9f8b2c4a3e
SHA512 94cca46aafe7138904a79693e0c97e0d72a0542e4d7a8a6778b4d4f0e68aa3dd90e7dbc0b34832a8875b10f32c3ca2bbaab446da0689c74ca295af4490c6783f
SSDEEP 24576:AMsSFgim2N2/YBtbDeC5sBAbwjHtAR5ddfKFT3Lt4gGLAl+quHMlKJM4L1aLKc7W:AliN15sBAbwjHtS5DfKFT3zGLAl+quHH
TLSH
T1EF450931AD7C457AEF6F89B096575226F95D29D21BA088EF82E0D44722311D3E331BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFA11.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIFA11.tmp
Size 917KB
SHA256 0fa9b28d3bb8e455ad61735f5259d5d9b8f65bcefa44f83f69db8a4ca451e5bd
MD5 afa8190a561a082dcc094e9ff8abdb4a
SHA1 3817097816d20ccbe8754e6c58bbbde937af9a20
SHA512 3deb8f142dc287246ab17cf45c1c501ffe39cd1e089d6b6d90cac8d958f873764615cdaf37be08cda19bc8354ca9ee94a8518d425802d3a289ea74a364a0f952
SSDEEP 24576:SQemY/mbo0ha/8EoUVSwAnA7h0lhSMXl0uVGgwiLFpZIH:SQXo0pMVSPDk2GgwiLFpZIH
TLSH
T1AE157C71268EC036F26E91B02B3D8E7F911D6E764BB108D763D4AD6A56314C2433AE37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Urban_TOS.html

Path C:\Users\Admin\AppData\Local\Temp\Urban_TOS.html
Size 17KB
SHA256 f284323553254d0915c06484ea6055bb4a67ee0125b4d81a7656aca09e80f527
MD5 89fc41bcfb4be7baf38473b332be83ba
SHA1 6a193e29f0eb32848aff45c1f35c1d10248dbdda
SHA512 c31c287eb7dbada072c567fcf2d71467e5671089e2d681c6a74d4d285321e67d8c476074d2d5f90eb167e23c49db2d53f44c326089ec2f7a6ea5b1f1a38737c6
SSDEEP 384:ZgovMHrC6LlrArNP68eXU04mNAgpUieLCTvHWe4Ps0DYRwc8u:/v2rCelM6X3RnPISHF
TLSH
T18382EA7FE34613B205C212557947A9E0F72A00686BF6A67134DA802B23D6E78437F779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f91a0d30-8bc0-42e1-a8d5-eea7c5508b77.tmp

Path C:\Users\Admin\AppData\Local\Temp\f91a0d30-8bc0-42e1-a8d5-eea7c5508b77.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39b24d62-fdd2-4349-ae6d-8a4a84b8cbd6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5616_775450795\39b24d62-fdd2-4349-ae6d-8a4a84b8cbd6.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5616_775450795\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shi2D7.tmp

Path C:\Users\Admin\AppData\Local\Temp\shi2D7.tmp
Size 4.3MB
SHA256 58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705
MD5 6c7cdd25c2cb0073306eb22aebfc663f
SHA1 a1eba8ab49272b9852fe6a543677e8af36271248
SHA512 17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6
SSDEEP 98304:U+VAwiFxfTTITz+DjHWtIXS3k/8HqoVN:nAwiDTqz+DjHWtIXS3k/8HqoV
TLSH
T127268E5167FA5799F7F35A3469B865658CBABC32ED21CB8D0252100A09B2E81CF74F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shi2E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\shi2E7.tmp
Size 81KB
SHA256 e99eab3c75989b519f7f828373042701329acbd8ceadf4f3ff390f346ac76193
MD5 125b0f6bf378358e4f9c837ff6682d94
SHA1 8715beb626e0f4bd79a14819cc0f90b81a2e58ad
SHA512 b63bb6bfda70d42472868b5a1d3951cf9b2e00a7fadb08c1f599151a1801a19f5a75cfc3ace94c952cfd284eb261c7d6f11be0ebbcaa701b75036d3a6b442db2
SSDEEP 1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
TLSH
T1E3835B61B74185B2C6EB347C953DB6BA927F51A04FA009C74B2466FE2D633C29E3424F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shi6B62.tmp

Path C:\Users\Admin\AppData\Local\Temp\shi6B62.tmp
Size 4.8MB
SHA256 047e2df9ccf0ce298508ee7f0db0abcb2ff9cff9916b6e8a1fbd806b7a9d064b
MD5 77d6c08c6448071b47f02b41fa18ed37
SHA1 e7fdb62abdb6d4131c00398f92bc72a3b9b34668
SHA512 e1aeb8e8b441d755a119f45a465ca5660678f4131984322252bfb6d2cec52e7ee54d65a64b98429b23915eb5707b04b5cd62a85446c60de8842314130a926dbd
SSDEEP 49152:gMZsU3djtq3DqVK5jE4b2tQ4wjn0P7mEQKhzN8F+X9TqVAMPLfRyim8UBpn6Hy:3Z2jE4/j4o/VAbis
TLSH
T1E1367E5563FA1398F6F78A38A9BA55559D76BC22EB11DBCF011201190AB2EC08F74F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 91fb66f2b80d4b521760537fd198968ac2453bf63bf6f4cfab355c5e02050663
MD5 acb0865c337ec9c5ac6e1d6b012d456d
SHA1 655cff93bac199f9659126c313a04e522e6ccf89
SHA512 c2cbb99329c2f33b45cf0941d16728b823a55d636255e192c612a789a41565a8989b4c13a5cdb093d11690bd02f82e29d9bdfd98d081327cb9da5bf5ed84b63f
SSDEEP 96:l6sPJUttwOtdt4sPJUqG6wFxqGYt4sPJUI24QwcI241T4sPJruDT84sPJnIu0:H6Dj8aV5JBIV
TLSH
T16B32FB546BF92A15F2F7AD72EA716B61AF3AB9265D08890D419041090C33F10ED3EF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UrbanVPN.msi

Path C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN 5.2.1.8262\install\CBCB962\UrbanVPN.msi
Size 9.3MB
SHA256 ab0ce1bf50a28a8b281bad1046c889135736f48bbc100157548e056fc4b3f322
MD5 2fc279aadf2ee5f72ce1740b80ecfded
SHA1 cbe6f747a770cd85c78022e0f826d52d7564fb60
SHA512 d2f6efa82b4b9df717bd305e57be230cf20467c1e01f77003b41d8b095ffd8b9227a9b578e2723407ea9d2f314ae30651dc90475595f0720c6a8ac4544978b01
SSDEEP 196608:lZB3spHOFT3FykUwHMXBiJAISpGaaaa8arab7aa7a:l33spHOFT1y24BiJ
TLSH
T1A4A6AF20BD5EC036E66F01719A2AAA2BE53D7CE10BB048CB53D4B8AA1D315C39735F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI707E.tmp

Path C:\Windows\Installer\MSI707E.tmp
Size 329KB
SHA256 a64119f041734f2eca66cb32ad397afeae9e793f3eab144dfdb1b48692f2ce6f
MD5 4595a3ee93deb2ffe37d7fd86792115f
SHA1 efe80ce610b4f4e456f1c99110e6749c5a87d48f
SHA512 0768af55f3d04ea0b41de2609558fb3234f9f7cf80b44e8815abe301dd4c972d49427107b7829939ac0a1c6925a075a524a085d248ffa9c9ee1b8a509c7a494a
SSDEEP 6144:xAm3R1zPBgbxjOka7nU8mlxMFmm1v9AGhWnC:xn3eb1a7nxEAzv3
TLSH
T1BE747C19B3A504B8E0B7927CC9A35906E7B67C160361D6CF23E046562F33BE4993EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI89FE.tmp

Path C:\Windows\Installer\MSI89FE.tmp
Size 423KB
SHA256 eb21efa033f38f24d87c1c259055a2618168268881be6ae06d734450fdf65f82
MD5 18cda9f5769af8d162f93889de623514
SHA1 cbb2d0ef2baa765715c67fcd9766f2fea3af1fa8
SHA512 bcca4f6dd4acf4a61b36ce5ad058c15535812de7362950959ff0373352b640fc8121b64523be6fc785aa603fe3441fce8a8b589a7ef9b11838eca6ff9b24cc2e
SSDEEP 6144:KVBkP0VtAJfL8A5elIDqacjFxqavMGuaCwph0lhSMXlBXBW/k4p6GMhyB:4WMIWhZ7Cwph0lhSMXl2k86yB
TLSH
T1EA94BF20B98AC032D61F05705D78AFAA8B2D7D614FE494CB93DC6CBB4D725C25B35A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e595349.msi

Path C:\Windows\Installer\e595349.msi
Size 208KB
SHA256 59a148da299c73d6bd4ef9a8e99736c3d3eabb3b9f895ad8ab183b657516cc22
MD5 cbb2aeab99bcc3085738c1c41fdf3225
SHA1 9462fcbb04046d68df7250f5124e79c269f771b2
SHA512 aec8238b7d7a4727b1f3fdcd5d3c6064bf72af6da5d8ef6542fe5fd97b8e24b7d15540426fae029a628d7e160f9fb31fc482edccc416d970f93656ecad0fd5e7
SSDEEP 3072:S9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTYBp:claZeKFxCnBheIdluO
TLSH
T1B824AE12B5808033DAFE1A350578DB615F3D7E608E54899B6364B6AD1E707C0CF3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{130D2AF2-76A9-4E93-90E6-2407A34986AC}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{362DA7E7-68D4-4C5A-A98D-5043E55B5429}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{362DA7E7-68D4-4C5A-A98D-5043E55B5429}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{362DA7E7-68D4-4C5A-A98D-5043E55B5429}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETEC99.tmp

Path C:\Windows\Temp\{58e2afc0-0a27-044c-97fa-4e311e03cfdd}\SETEC99.tmp
Size 2KB
SHA256 f4ad125570e5e96da38ca0e6f35cb6c614b59d7d7f9844705595db78c29706a5
MD5 2892ed63170b894aa7e7d0b2a82562df
SHA1 2da352f5bb5fe4c67e70d0007ca936fe20cacaca
SHA512 3cbfb2d8322ec20717502608f09243fa146751d0e10a581bc292d1b4ea895584dd4be7ae3177e637c435c5a3eb9f7b462fd6c94e2e57d1894b72820075ab4c8f
TLSH
T1C441F14A52C20FF93B432D7596077BA2B9D6910050C8152AF48C96468B8FF99B31B7FB
MD5 SHA1 SHA512 TLSH

Submit Download

ovpn-dco.cat

Path C:\Windows\Temp\{58e2afc0-0a27-044c-97fa-4e311e03cfdd}\ovpn-dco.cat
Size 11KB
SHA256 04307eb219dad34af984249e116886698278974572ac61190f883861305b5606
MD5 3f5b71e7076645a3c43a811d8f4d1227
SHA1 31dbbafbd58ce6ae4a8592e71c9dc2d9a02e91b4
SHA512 54615f34041096c14dacdc2cf7e3124ae6b41994989f7babf67e98f5d94d32014138e20805bfe6ffc0b55949ca5ab34dfcb9dac09395b07915e4dbf998f1b23f
SSDEEP 192:QNhqDeJCxkpPXWEwGJhYC0/bV46X01k9z3AlzlnfbWXN:E0kpP3h30/FR9zIxbe
TLSH
T119322AE2459C50C2DD47AC6052E8E9473C3D77CB5C1195BA22EBFA241DA33C8F7246AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ovpn-dco.sys

Path C:\Windows\Temp\{58e2afc0-0a27-044c-97fa-4e311e03cfdd}\ovpn-dco.sys
Size 142KB
SHA256 3e3bb5283630b5bd26556439d82388998167fd5a20c9adc9696c63502a402205
MD5 5b0fd269b7032fef120e782fa6c51119
SHA1 210961725066daf058a38fcf7d996ea81e665fa3
SHA512 c7ac5177dd64a88e59f9667598c6aae2178733055a5e23c516b3da76559533bfc8f098500cadd927629dfef25156967ca11f2fcc9c8b3dab3890f8e7f40e1c51
SSDEEP 3072:ZueZoTPJK0DVr9RX6JzLRJfFmTS2AfRCi:ZuModK0DVLX0L3b2aJ
TLSH
T19FE32975A5D410D4E43BE1B896B64E41BFB0BA523F329AEF050089A80F367D8FE39745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{D9D795E2-D191-46B9-917C-1F81D3E8B60D}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{D9D795E2-D191-46B9-917C-1F81D3E8B60D}\.be\VC_redist.x64.exe
Size 670KB
SHA256 1ec6ded595b12262d8bfcf8436046c9d84febff424924cb839a1946dad76ca4e
MD5 261f741c93973d184d4fccf833f0c075
SHA1 cb7846fc45cc545b3ac6ab0aa3425461e219b196
SHA512 90ca6a11c6bbd5f97d1ed146da5279bf40330bf9020b40eb816ede0d914ed4d769e9c48cb8c839924700dec818d4f818f89e6d6afbc7091e2a2809ebe099da81
SSDEEP 12288:Z3mgqnIZuYfCYqFet4CovkM7pu1nEMSgKZLrfDDIcbMZ3MyGb:Z3WnIZuMCxezot7ohEDfDBMZ8yM
TLSH
T120E49D32A5614033F7F10573B928A6303E7CE3282B51C8A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1708-2500-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2365-0x000001334B150000-0x000001334B352000-memory.dmp

Download

memory/1708-2462-0x000001334DDE0000-0x000001334DDE1000-memory.dmp

Download

memory/1708-2461-0x000001334DDE0000-0x000001334DDE1000-memory.dmp

Download

memory/1708-2472-0x000001334DDF0000-0x000001334DDF1000-memory.dmp

Download

memory/1708-2473-0x000001334DDE0000-0x000001334DDE1000-memory.dmp

Download

memory/1708-2465-0x000001334DDF0000-0x000001334DDF1000-memory.dmp

Download

memory/1708-2487-0x000001334DDE0000-0x000001334DDE1000-memory.dmp

Download

memory/1708-2486-0x000001334DDE0000-0x000001334DDE1000-memory.dmp

Download

memory/1708-2492-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2491-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2495-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2497-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2499-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2503-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2508-0x000001334F590000-0x000001334F591000-memory.dmp

Download

memory/1708-2507-0x000001334F590000-0x000001334F591000-memory.dmp

Download

memory/1708-2506-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2505-0x000001334F590000-0x000001334F591000-memory.dmp

Download

memory/1708-2502-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2364-0x000001334AD00000-0x000001334B142000-memory.dmp

Download

memory/1708-2498-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2496-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2494-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2493-0x000001334F580000-0x000001334F581000-memory.dmp

Download

memory/1708-2518-0x000001334F590000-0x000001334F591000-memory.dmp

Download

memory/1708-2517-0x000001334F5B0000-0x000001334F5B1000-memory.dmp

Download

memory/1708-2515-0x000001334F590000-0x000001334F591000-memory.dmp

Download

memory/1708-2514-0x000001334F590000-0x000001334F591000-memory.dmp

Download

memory/1708-2523-0x000001334F5B0000-0x000001334F5B1000-memory.dmp

Download

memory/1708-2522-0x000001334F6E0000-0x000001334F6E2000-memory.dmp

Download

memory/1708-2463-0x000001334DDE0000-0x000001334DDE1000-memory.dmp

Download

memory/1708-2521-0x000001334F6E0000-0x000001334F6E2000-memory.dmp

Download

memory/1708-2551-0x000001334F590000-0x000001334F591000-memory.dmp

Download

memory/1708-2552-0x000001334F6E0000-0x000001334F6E2000-memory.dmp

Download

memory/1708-2554-0x000001334F6E0000-0x000001334F6E2000-memory.dmp

Download

memory/1708-2553-0x000001334F6E0000-0x000001334F6E2000-memory.dmp

Download

memory/1708-2557-0x000001334F720000-0x000001334F721000-memory.dmp

Download

memory/1708-2555-0x000001334F6E0000-0x000001334F6E2000-memory.dmp

Download

memory/1708-2565-0x000001334F7A0000-0x000001334F7A2000-memory.dmp

Download

memory/1708-2573-0x000001334F7B0000-0x000001334F7B1000-memory.dmp

Download

memory/1708-2575-0x000001334F7B0000-0x000001334F7B1000-memory.dmp

Download

memory/1708-2566-0x000001334F7A0000-0x000001334F7A2000-memory.dmp

Download

memory/1708-2574-0x000001334F7B0000-0x000001334F7B1000-memory.dmp

Download

memory/1708-2572-0x000001334F720000-0x000001334F721000-memory.dmp

Download

memory/1708-2571-0x000001334F7B0000-0x000001334F7B1000-memory.dmp

Download

memory/1708-2570-0x000001334F7B0000-0x000001334F7B1000-memory.dmp

Download

memory/1708-2568-0x000001334F720000-0x000001334F721000-memory.dmp

Download

memory/1708-2567-0x000001334F720000-0x000001334F721000-memory.dmp

Download

memory/1708-2564-0x000001334F720000-0x000001334F721000-memory.dmp

Download

memory/1708-2563-0x000001334F7A0000-0x000001334F7A2000-memory.dmp

Download

memory/1708-2561-0x000001334F720000-0x000001334F721000-memory.dmp

Download

memory/1708-2323-0x00007FFFEEA70000-0x00007FFFEF079000-memory.dmp

Download

memory/1708-2722-0x0000013350950000-0x0000013350951000-memory.dmp

Download

memory/1708-2720-0x0000013350940000-0x0000013350941000-memory.dmp

Download

memory/1708-2776-0x0000013350940000-0x0000013350941000-memory.dmp

Download

memory/1708-2769-0x000001334F7B0000-0x000001334F7B1000-memory.dmp

Download

memory/1708-2767-0x000001334F7B0000-0x000001334F7B1000-memory.dmp

Download

memory/2064-1424-0x0000000000810000-0x0000000000887000-memory.dmp

Download

memory/2756-2733-0x00007FFFEEA70000-0x00007FFFEF079000-memory.dmp

Download

memory/2756-2732-0x00007FFFEEA70000-0x00007FFFEF079000-memory.dmp

Download

memory/2864-1421-0x0000000000810000-0x0000000000887000-memory.dmp

Download

memory/4264-1423-0x0000000000810000-0x0000000000887000-memory.dmp

Download

memory/5160-2062-0x00007FFFEEA70000-0x00007FFFEF079000-memory.dmp

Download