Overview
overview
8Static
static
3TurboVPN_setup.exe
windows10-ltsc_2021-x64
8$PLUGINSDIR/logo.ico
windows10-ltsc_2021-x64
3Driver32/d...01.sys
windows10-ltsc_2021-x64
3Driver32/d...01.sys
windows10-ltsc_2021-x64
3Driver32/d...01.sys
windows10-ltsc_2021-x64
3Driver32/d...01.sys
windows10-ltsc_2021-x64
3TurboVPN.exe
windows10-ltsc_2021-x64
6WebView2Loader.dll
windows10-ltsc_2021-x64
3WinSparkle.dll
windows10-ltsc_2021-x64
3breakpad.dll
windows10-ltsc_2021-x64
3dbghelp.dll
windows10-ltsc_2021-x64
3installtapx64.exe
windows10-ltsc_2021-x64
8installtapx86.exe
windows10-ltsc_2021-x64
4ipsec/ipsec.exe
windows10-ltsc_2021-x64
3libuv.dll
windows10-ltsc_2021-x64
3openvpn/libeay32.dll
windows10-ltsc_2021-x64
3openvpn/li...-1.dll
windows10-ltsc_2021-x64
3tools/clientdl.exe
windows10-ltsc_2021-x64
3trojan/lib..._1.dll
windows10-ltsc_2021-x64
3trojan/libssl-1_1.dll
windows10-ltsc_2021-x64
3trojan/vcr...40.dll
windows10-ltsc_2021-x64
3trojan/xpntroj.exe
windows10-ltsc_2021-x64
3tun2socks.exe
windows10-ltsc_2021-x64
3turbo_vpn-service.exe
windows10-ltsc_2021-x64
3uninst.exe
windows10-ltsc_2021-x64
4v2ray/v2ray.exe
windows10-ltsc_2021-x64
3wfpcallout...ut.sys
windows10-ltsc_2021-x64
3wfpcallout...ut.sys
windows10-ltsc_2021-x64
3wfpcallout...ut.sys
windows10-ltsc_2021-x64
3wfpcallout...ut.sys
windows10-ltsc_2021-x64
3windui.dll
windows10-ltsc_2021-x64
3xray/xray.exe
windows10-ltsc_2021-x64
3Analysis
- user interaction
yes - max time kernel
614s - max time network
618s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
09/08/2026, 03:54
Behavioral task
behavioral1
Sample
TurboVPN_setup.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
30 signatures
900 seconds
Behavioral task
behavioral2
Sample
$PLUGINSDIR/logo.ico
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
Driver32/driver_win10_x64/tap0901.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
Driver32/driver_win10_x86/tap0901.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral5
Sample
Driver32/driver_win7_x64/tap0901.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral6
Sample
Driver32/driver_win7_x86/tap0901.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral7
Sample
TurboVPN.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
18 signatures
900 seconds
Behavioral task
behavioral8
Sample
WebView2Loader.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral9
Sample
WinSparkle.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral10
Sample
breakpad.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral11
Sample
dbghelp.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral12
Sample
installtapx64.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
7 signatures
900 seconds
Behavioral task
behavioral13
Sample
installtapx86.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral14
Sample
ipsec/ipsec.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral15
Sample
libuv.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral16
Sample
openvpn/libeay32.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral17
Sample
openvpn/libpkcs11-helper-1.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral18
Sample
tools/clientdl.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral19
Sample
trojan/libcrypto-1_1.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral20
Sample
trojan/libssl-1_1.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral21
Sample
trojan/vcruntime140.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral22
Sample
trojan/xpntroj.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral23
Sample
tun2socks.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral24
Sample
turbo_vpn-service.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral25
Sample
uninst.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
900 seconds
Behavioral task
behavioral26
Sample
v2ray/v2ray.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral27
Sample
wfpcallout/x64/win10/PiaWfpCallout.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral28
Sample
wfpcallout/x64/win7/PiaWfpCallout.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral29
Sample
wfpcallout/x86/win10/PiaWfpCallout.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral30
Sample
wfpcallout/x86/win7/PiaWfpCallout.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral31
Sample
windui.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral32
Sample
xray/xray.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
General
- Target TurboVPN_setup.exe
- Size 33.8MB
- Sample260809-egqm3agf33
- SHA256 0bdcd61806c39669def024f9fa1f2e483292c3a20c758e1de7b189a012d8b312
- MD5 12bfd14b5e04da1d9755eaf3ee33ba38
- SHA1 725d88ba873ad0529b1cff9e17186bf59849cfb4
- SHA512 f3a1d20adffee359a895713a28d66006cb5161214335b21dbbf5e10c1016bfd9a285ab55113c6ba2d06ae86f9a182d1dc95fd7ce46dce70d73aa6a0084968d89
- SSDEEP 786432:7MC9QfDr26BN4uW4wT43nyUjkbZrzfdtwSlij6LkHukxxr:QCEDvw4wToSFjjzLkOk7
- TLSH T12C7733AEAC91C4F0F05B6BB15B3C6B641D50BBFAB916E126F35EED908E10801CD0D96D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\system32\DRIVERS\SETD9ED.tmp installtapx64.exe File created C:\Windows\system32\DRIVERS\SETD9ED.tmp installtapx64.exe File opened for modification C:\Windows\system32\DRIVERS\PiaWFPCallout.sys installtapx64.exe File opened for modification C:\Windows\System32\drivers\SETD895.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETD895.tmp DrvInst.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TurboVPN = "C:\\Program Files (x86)\\TurboVPN\\TurboVPN.exe" TurboVPN_setup.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 61 ip-api.com 425 ip-api.com - Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 TurboVPN_setup.exe File opened for modification \??\PhysicalDrive0 TurboVPN.exe - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{793cef43-5809-c54c-a331-f51cbe71d864} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\oemvista.PNF installtapx64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{793cef43-5809-c54c-a331-f51cbe71d864}\SETD691.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{793cef43-5809-c54c-a331-f51cbe71d864}\SETD6C2.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{793cef43-5809-c54c-a331-f51cbe71d864}\SETD6C2.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{793cef43-5809-c54c-a331-f51cbe71d864}\SETD691.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{793cef43-5809-c54c-a331-f51cbe71d864}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{793cef43-5809-c54c-a331-f51cbe71d864}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{793cef43-5809-c54c-a331-f51cbe71d864}\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_6d4bec28a2ef0cdf\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{793cef43-5809-c54c-a331-f51cbe71d864}\SETD6B1.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{793cef43-5809-c54c-a331-f51cbe71d864}\SETD6B1.tmp DrvInst.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\TurboVPN\temp\mainbanner.download TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\temp\90d0815ae3784b5170254900c853ffbd.zip.download TurboVPN.exe File opened for modification C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_uk.png TurboVPN.exe File opened for modification C:\Program Files (x86)\TurboVPN\data\plans.dat TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\trojan\vcruntime140.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\v2ray\geoip.dat TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\v2ray\v2ray.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\Driver32\driver_win10_x64\tap0901.cat TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_en.png TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\temp\d45306d4ee783b7124df0d7b9a23df7b.zip.download TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\TurboVPN.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\uninst.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\libuv.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\temp\bc4536c046c622889eb55fcfe2cf6e9f.zip TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\openvpn\tap-windows.exe TurboVPN_setup.exe File opened for modification C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_ar.png TurboVPN.exe File opened for modification C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_ko.png TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\installtapx86.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\dbghelp.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\ipsec\ipsec.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\ssr\libPrivoxy.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\wfpcallout\x64\win10\piawfpcallout.cat TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_id.png TurboVPN.exe File opened for modification C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_ru.png TurboVPN.exe File opened for modification C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_tr.png TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\temp\411a91cbc612294a3b585a10e7d829b6.zip TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\temp\mainbanner TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\openvpn\ssleay32.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\ssr\ssr.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\v2ray\geosite.dat TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\data\payurl.dat TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\temp\f7757a77dd18d0446f68f2708b6fa3e9.zip.download TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\tools\clientdl.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\data\ustatus.dat TurboVPN.exe File opened for modification C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_default.png TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_ru.png TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\temp\4651c47136846916fdb115eec890b0a6.zip TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\temp\88f834b0ea7e9907f573c8c326549220.zip TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\openvpn\libpkcs11-helper-1.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\openvpn\vpncore.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\data\uactive.dat TurboVPN.exe File opened for modification C:\Program Files (x86)\TurboVPN\data\remote_config.dat TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_de.png TurboVPN.exe File opened for modification C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_es.png TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\WebView2Loader.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\breakpad.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\windui.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\ssr\bloom.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\service.cfg turbo_vpn-service.exe File created C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_ko.png TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_uk.png TurboVPN.exe File opened for modification C:\Program Files (x86)\TurboVPN\temp\90d0815ae3784b5170254900c853ffbd.zip.download TurboVPN.exe File created C:\Program Files (x86)\TurboVPN\tun2socks.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\payment.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\data\proxyIp.dat TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\openvpn\lzo2.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\ssr\libsodium.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\ssr\ssr-client-lib.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\trojan\libcrypto-1_1.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\wfpcallout\x64\win10\PiaWfpCallout.sys TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\openvpn\libeay32.dll TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\xray\xray.exe TurboVPN_setup.exe File created C:\Program Files (x86)\TurboVPN\Driver32\driver_win10_x64\OemVista.inf TurboVPN_setup.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_1407394903\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-gu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-hr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-kn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-sv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-tk.hyb msedgewebview2.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_424698842\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-bg.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-de-1996.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-lt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-nl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-pa.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-et.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-ka.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_2121605010\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-en-gb.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-ru.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_424698842\male_names.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_424698842\test.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_424698842\us_tv_and_film.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-pt.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_424698842\ranked_dicts msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-af.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-da.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_424698842\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_1407394903\crs.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-fr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-it.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-te.hyb msedgewebview2.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_424698842\english_wikipedia.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_424698842\passwords.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_1407394903\ct_config.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-as.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-la.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-mr.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-nn.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-cs.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-en-us.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-lv.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-sk.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-und-ethi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-be.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-eu.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-or.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-sq.hyb msedgewebview2.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-hi.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-sl.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_1407394903\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-cy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-el.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-es.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-hy.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-ml.hyb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-nb.hyb msedgewebview2.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Executes dropped EXE 12 IoCs
pid Process 4124 installtapx64.exe 1576 installtapx64.exe 5100 installtapx64.exe 4648 turbo_vpn-service.exe 4536 turbo_vpn-service.exe 5928 TurboVPN.exe 4384 installtapx64.exe 5212 installtapx64.exe 4104 ssrxray.exe 4416 xray.exe 1792 tun2socks.exe 1512 TurboVPN.exe - Loads dropped DLL 32 IoCs
pid Process 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4648 turbo_vpn-service.exe 4536 turbo_vpn-service.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 4104 ssrxray.exe 1512 TurboVPN.exe 1512 TurboVPN.exe 1512 TurboVPN.exe 1512 TurboVPN.exe 1512 TurboVPN.exe 1512 TurboVPN.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA TurboVPN.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F7368FDF02C8183B8E462BAE2C296B0A9767CCF2\Blob = 030000000100000014000000f7368fdf02c8183b8e462bae2c296b0a9767ccf22000000001000000400500003082053c30820324a00302010202086cbe7f9e3cbde3b2300d06092a864886f70d01010c0500303c310b300906035504061302555331133011060355040a130a5374726f6e675377616e311830160603550403130f5468697349735370617274612e7765301e170d3232303732313037313732305a170d3235303732303037313732305a303c310b300906035504061302555331133011060355040a130a5374726f6e675377616e311830160603550403130f5468697349735370617274612e776530820222300d06092a864886f70d01010105000382020f003082020a0282020100f432a3fbfcb67756ebfbac2ed98c30a298177f22bf595fa11353b5804b5a1fbefcf1fef64c3b5cfd856710cfab5b8dd546a938ef47ca7b0c58d853be8b69b503e996224fdf76dd5f9e9d25d44c05d749d960ad7973468359a6d2a1a6af8bfafe44ce91ec0377a8da59251fc4529b03d58815f447b3692d0a11735dd6b6b597048505106965389b7b0e202e7f69126e3b795e683f7caff80dbebc6cd341e96a9a38e566f8363c670ed1ddf0bf0e1b3d25c8417648ebb65d57b6b9365c48bc7af6c1df2e5873649aaebc9f3588fb4a0bfe2f5d74d80952970abb52278a82797eb73dfa0bc6caf061c813fb9e23f6295492dd0a6ebb5467fc91845deb9da11002a1bf55d36db96ab9fd83ea3368031206a948afdc848c387c1b9a976d899f170c0335669e2ea25dcefb51211ac3dcaf02b0055115536eb314949c92f7ccc4f2cd39dd20f2921b3b8e4bc9dc8e48500b744d4dc6a929b40b2878f7b8560c26a05b6e01877abc2fe2978ad2ca658cd0d1ba6548030535b35651085570fabff5985f53001dd02da8472d425edc9ebb78a1cf7336f7e301279f886ccd5b219e32a9952417fd0fdafc626b97fda41e00d67756bfa8049d3cf81064b5bb438f0f723e7efd6401e1cecf8ed752eb8ba4408b018448fdcba8dc9c9037292dc0379d1607b2680e4cbe9475fb97f99b97313e4818a7d6fdda826034db4f802f4d514ce3e724e70203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414f09a36369b890ed80f99327625cfa09337f48260300d06092a864886f70d01010c05000382020100609dce0b15f2320efd57a2f382e5a8efe641bb5f36f4cb6f4b2d77c9379deb3efc93c5090b445817574c9127118ccba6d0a3c3177c9c5971fe56dbb21aa8ff883f380c35aa42992f3fb763c7958af31177cbd6933b311c3260f474441c5db4e21c436850c777bffc400c1f56759d3df741651664a4edc00248de942aaa7e790c03ee8072baf596bb7aeee73735094e9afc2832a00ebc21bd73093052fc5d6dda4f37320465589805fc5c34090a857045bc7b28358e09ed649ae45de305e44c7611da3710d1352673adbc5e343b93cf04e25e3c4542d03e132a06cf93c5e0585c0f3d417d0249922555a6017f7f4e39ec42e46a0f6e66acd02b015a40798d55f6a24f1d2e5460be4a791bd1703e7cfe6b91fd54c07fcc38e145322eba1980132cf021dfe31274221de91003de34fc7d754dfccc8f40bb1b7600b794a21b77b5b8a054419cccc787964fb3ba1cf19344e70233cea995d542424f00ebbc3f00ca93e4620af291a46b8bebdf87f9920cba8d699125621069f1682ddf51528109b1fc1c88bc88925b6af83290577f54f4f7a5b5af6677ff18a5fe2707a489eed8632fd8951fb53aa18fe9e6b28bfb863fa8641c59e4c92edefb0619c53bc9ac8b4c1413cba900a85799e169a7322c42cee290134d33b5b151626dea93f0f61fe29e9b1badc82b78ade3381000b5d11e3cd40a23225ed66c70fc63299468b69e3fc670 TurboVPN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BD64C2D055660BBA0D25407BEB628A1AE8124DFF\Blob = 030000000100000014000000bd64c2d055660bba0d25407beb628a1ae8124dff2000000001000000500500003082054c30820334a00302010202085e821afad743f86d300d06092a864886f70d01010c05003044310b300906035504061302555331133011060355040a130a5374726f6e675377616e3120301e060355040313175468697349735370617274612e77653230323230373036301e170d3232303730363039343234375a170d3235303730353039343234375a3044310b300906035504061302555331133011060355040a130a5374726f6e675377616e3120301e060355040313175468697349735370617274612e7765323032323037303630820222300d06092a864886f70d01010105000382020f003082020a0282020100c2c70bf752bbb7cb04b279494bf348d80b959b68af723e970aaf313b86fb0fdbfe9a7762f6ab1179af90579bb7f5b28e01e14a9d81fe1fd72fa16e9d19b5a5816150685d2536e026dab5ba26b9a6eafc4620a09b6d07fc748a9ec30115e513b6de27f540863350589cbd09f03fb6b0ff5d6dff8e3255a15168b3e43129f754654cdd808a67ef924fd4798e88fabb6dd018200e0fe6b6988a4dbaacf4823f9b81b87ebd76a44e7542ea8fe954f12943655cb31a14c2aca42532702da138762cdfd9a94b0ec94b94cbcc13b699653b2b55dab22b649433e39c0b72c6853cf88ffaf7f8443f3272073cfc13b6ab1f597ed6f5323c66a8ed2f68267fda0fe485cf03921cbeea8111677e5d61d8719099a1611b437207242a7cbf5a099f8b757080b5e5557a08260310917a48732c1dd60ee0b108b93b983156e9461c1aed29bd7b55b4e1bd189fad6b03cda097187860607bbd2d7898e44e3f61aa59ad41d1a475bc7b701cb1a96d4b133d45ed3579dc3b664c08db111c95f6202fa64003fa933468990e5a6a2eafefafed8661b14afdc903643281cb26f40739b0dcb61d511e8cc23703f92eb0f0c655462db3dba7ede7c9a0c5416025a87fc8fd1be654162a4c31e0de6a8cf1a63dd4911692cd9488fae76f87a8c2318f521e6d432710cc44163c8d988081958d2a0b6227a79dd1f70c263e29d9ac6d13fb441c6723756597d7350203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604146a8978ca5ef5c04ba2732e3b517ff3287e94233d300d06092a864886f70d01010c05000382020100762ea81f070c8c10c11ca6996f4fa2cf9983356a1d7d25dcc2f06ec0829db3c8d58e64269db60a6845fee712be84d9a7422caa18660053e546b55958445519d6490b9a9b0f23230e8b9275dc1d9c418cce1b351789128dead8c175b4ec6a12d4b6eef64633fdd2d1d871bf569ee491b15fed5a672ce72179fd293c1c6d29bd171489d4a8814790a81db6f4f72dce970b609ff019c228ee9458d8014af81847967caaace27d58ff20bdacebf2234603610c4d24a54cbbbd68acda3f51f75b71ce42b7382e80cb6baaaa5b5068360aa389adc60e30b562702461d503a1e7cf1dae15cde5f109a3b6bba23634fafb6ae5f01089fccc998f837c5a873a76f60b4ec318d7e05a39a3b38c66e9e300b746f68ba9b9173b04f10c8c0d4bc97c9002cda0f7b9b441abdf48376bf68b246f3ef04b668bd5e20c6c4180b89bc148f881c45afe44f0ec1dd8c9a25b03e3f2632d4bc90b588bfa8bc1d3ca2adc2c873912993bc96fe841e043a8d76e77ace7aae193dd323df4db03df45352eef9da535288de71f798dc25f32af4a02e0f28872acfa5f1cd17497b8460fefd5dbc5ecbdaecad1063589cd714f92550db5626613db6a7508ce3300b58e0584ccb032823f483643d0b856249ba24a06673dede272901d242edaedfc101fec5c5b23b8f2cecd6fbdfc65c24d69395299b97a04fdbf4acb9c523e486455e88c35b3ebd575069dc22c TurboVPN.exe - System Location Discovery: System Language Discovery 1 TTPs 29 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language turbo_vpn-service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tun2socks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TurboVPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ssrxray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TurboVPN_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TurboVPN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language turbo_vpn-service.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language route.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2604 chrome.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags installtapx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs installtapx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 installtapx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID installtapx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 installtapx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID installtapx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 installtapx64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs installtapx64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service DrvInst.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe - Enumerates system info in registry 2 TTPs 10 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion TurboVPN_setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion TurboVPN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS TurboVPN.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS TurboVPN_setup.exe - Modifies data under HKEY_USERS 44 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307218845149650" msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe - Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TurboVPN\shell\Open TurboVPN_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TurboVPN\shell\Open\ TurboVPN_setup.exe Key created \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428 chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104" chrome.exe Key created \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TurboVPN TurboVPN_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TurboVPN\shell TurboVPN_setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TurboVPN\shell\Open\command TurboVPN_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TurboVPN\shell\Open\command\ = "C:\\Program Files (x86)\\TurboVPN\\TurboVPN.exe %1" TurboVPN_setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2684263265-1628758615-802431902-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox" chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TurboVPN\ = "URL:TurboVPN" TurboVPN_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TurboVPN\URL Protocol TurboVPN_setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TurboVPN\shell\ TurboVPN_setup.exe - Modifies system certificate store 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BD64C2D055660BBA0D25407BEB628A1AE8124DFF TurboVPN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F7368FDF02C8183B8E462BAE2C296B0A9767CCF2 TurboVPN.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 4508 TurboVPN_setup.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 4104 ssrxray.exe 4104 ssrxray.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 2176 chrome.exe 2176 chrome.exe 2668 msedgewebview2.exe 2668 msedgewebview2.exe 2176 chrome.exe 2176 chrome.exe 4220 chrome.exe 4220 chrome.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 676 Process not Found - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
pid Process 4472 msedgewebview2.exe 4472 msedgewebview2.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAuditPrivilege 5552 svchost.exe Token: SeSecurityPrivilege 5552 svchost.exe Token: SeLoadDriverPrivilege 4124 installtapx64.exe Token: SeRestorePrivilege 2548 DrvInst.exe Token: SeBackupPrivilege 2548 DrvInst.exe Token: SeLoadDriverPrivilege 2548 DrvInst.exe Token: SeLoadDriverPrivilege 2548 DrvInst.exe Token: SeLoadDriverPrivilege 2548 DrvInst.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe Token: SeShutdownPrivilege 2176 chrome.exe Token: SeCreatePagefilePrivilege 2176 chrome.exe - Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 5928 TurboVPN.exe - Suspicious use of SendNotifyMessage 47 IoCs
pid Process 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 5928 TurboVPN.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 2176 chrome.exe 5928 TurboVPN.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 4124 4508 TurboVPN_setup.exe 94 PID 5552 wrote to memory of 1852 5552 svchost.exe 96 PID 5552 wrote to memory of 2548 5552 svchost.exe 97 PID 4508 wrote to memory of 1576 4508 TurboVPN_setup.exe 100 PID 4508 wrote to memory of 5100 4508 TurboVPN_setup.exe 101 PID 4508 wrote to memory of 4648 4508 TurboVPN_setup.exe 102 PID 5928 wrote to memory of 4384 5928 TurboVPN.exe 110 PID 5928 wrote to memory of 5212 5928 TurboVPN.exe 111 PID 5928 wrote to memory of 4472 5928 TurboVPN.exe 112 PID 4472 wrote to memory of 5720 4472 msedgewebview2.exe 113 PID 4472 wrote to memory of 3912 4472 msedgewebview2.exe 114 PID 4472 wrote to memory of 3912 4472 msedgewebview2.exe 114 PID 4472 wrote to memory of 3912 4472 msedgewebview2.exe 114 PID 4472 wrote to memory of 3552 4472 msedgewebview2.exe 115 PID 4472 wrote to memory of 1820 4472 msedgewebview2.exe 116 PID 4472 wrote to memory of 1820 4472 msedgewebview2.exe 116 PID 4472 wrote to memory of 3696 4472 msedgewebview2.exe 117 PID 4472 wrote to memory of 3696 4472 msedgewebview2.exe 117 PID 4472 wrote to memory of 3696 4472 msedgewebview2.exe 117 PID 4472 wrote to memory of 4860 4472 msedgewebview2.exe 118 PID 4472 wrote to memory of 4860 4472 msedgewebview2.exe 118 PID 4472 wrote to memory of 4860 4472 msedgewebview2.exe 118 PID 5928 wrote to memory of 5000 5928 TurboVPN.exe 121 PID 5928 wrote to memory of 5200 5928 TurboVPN.exe 123 PID 5928 wrote to memory of 2824 5928 TurboVPN.exe 125 PID 5928 wrote to memory of 1288 5928 TurboVPN.exe 127 PID 5928 wrote to memory of 5168 5928 TurboVPN.exe 129 PID 5928 wrote to memory of 3632 5928 TurboVPN.exe 131 PID 5928 wrote to memory of 4104 5928 TurboVPN.exe 133 PID 4104 wrote to memory of 4416 4104 ssrxray.exe 135 PID 5928 wrote to memory of 1792 5928 TurboVPN.exe 137 PID 4508 wrote to memory of 1512 4508 TurboVPN_setup.exe 139 PID 4472 wrote to memory of 3612 4472 msedgewebview2.exe 141 PID 4472 wrote to memory of 3612 4472 msedgewebview2.exe 141 PID 2176 wrote to memory of 5840 2176 chrome.exe 147 PID 2176 wrote to memory of 444 2176 chrome.exe 148 PID 2176 wrote to memory of 2604 2176 chrome.exe 149 PID 2176 wrote to memory of 444 2176 chrome.exe 148 PID 2176 wrote to memory of 3824 2176 chrome.exe 150 PID 2176 wrote to memory of 3824 2176 chrome.exe 150 PID 2176 wrote to memory of 5556 2176 chrome.exe 151 PID 2176 wrote to memory of 3144 2176 chrome.exe 152 PID 2176 wrote to memory of 5556 2176 chrome.exe 151 PID 2176 wrote to memory of 3144 2176 chrome.exe 152 PID 2176 wrote to memory of 2800 2176 chrome.exe 154 PID 2176 wrote to memory of 2800 2176 chrome.exe 154 PID 2176 wrote to memory of 4724 2176 chrome.exe 155 PID 2176 wrote to memory of 4724 2176 chrome.exe 155 PID 2176 wrote to memory of 5792 2176 chrome.exe 156 PID 2176 wrote to memory of 384 2176 chrome.exe 161 PID 2176 wrote to memory of 384 2176 chrome.exe 161 PID 4472 wrote to memory of 2668 4472 msedgewebview2.exe 162 PID 2176 wrote to memory of 1964 2176 chrome.exe 163 PID 2176 wrote to memory of 2824 2176 chrome.exe 164 PID 2176 wrote to memory of 760 2176 chrome.exe 165 PID 4472 wrote to memory of 1352 4472 msedgewebview2.exe 166 PID 4472 wrote to memory of 1352 4472 msedgewebview2.exe 166 PID 2176 wrote to memory of 1680 2176 chrome.exe 167 PID 2176 wrote to memory of 1680 2176 chrome.exe 167 PID 4472 wrote to memory of 1092 4472 msedgewebview2.exe 168 PID 4472 wrote to memory of 1092 4472 msedgewebview2.exe 168 PID 2176 wrote to memory of 4220 2176 chrome.exe 169 PID 2176 wrote to memory of 1320 2176 chrome.exe 170 PID 2176 wrote to memory of 1320 2176 chrome.exe 170
Processes
-
C:\Users\Admin\AppData\Local\Temp\TurboVPN_setup.exe"C:\Users\Admin\AppData\Local\Temp\TurboVPN_setup.exe"1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Program Files (x86)\TurboVPN\installtapx64.exe"C:\Program Files (x86)\TurboVPN\installtapx64.exe" "c" /S2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Program Files (x86)\TurboVPN\installtapx64.exe"C:\Program Files (x86)\TurboVPN\installtapx64.exe" "C:\Program Files (x86)\TurboVPN" -removeCalloutDriver "C:\Program Files (x86)\TurboVPN" /S2⤵
- Executes dropped EXE
PID:1576
-
-
C:\Program Files (x86)\TurboVPN\installtapx64.exe"C:\Program Files (x86)\TurboVPN\installtapx64.exe" "C:\Program Files (x86)\TurboVPN" -installCalloutDriver "C:\Program Files (x86)\TurboVPN" /S2⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:5100
-
-
C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe"C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe" install2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4648
-
-
C:\Program Files (x86)\TurboVPN\TurboVPN.exe"C:\Program Files (x86)\TurboVPN\TurboVPN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1512
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{69300545-eb1a-7a4e-85b6-c53714b334cd}\oemvista.inf" "9" "4d14a44ff" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "c:\program files (x86)\turbovpn\driver32\driver_win10_x64"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1852
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.2.601:tap0901," "4d14a44ff" "00000000000001CC"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe"C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe"1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4536
-
C:\Program Files (x86)\TurboVPN\TurboVPN.exe"C:\Program Files (x86)\TurboVPN\TurboVPN.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5928 -
C:\Program Files (x86)\TurboVPN\installtapx64.exe"C:\Program Files (x86)\TurboVPN\installtapx64.exe" -removeCalloutDriver C:\Program Files (x86)\TurboVPN /S2⤵
- Executes dropped EXE
PID:4384
-
-
C:\Program Files (x86)\TurboVPN\installtapx64.exe"C:\Program Files (x86)\TurboVPN\installtapx64.exe" -removeCalloutDriver C:\Program Files (x86)\TurboVPN /S2⤵
- Executes dropped EXE
PID:5212
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=5928.5864.64142050873016625772⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\.TurboVPN\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\.TurboVPN\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffba26eb078,0x7ffba26eb084,0x7ffba26eb0903⤵PID:5720
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1844,i,11878869236967766237,1607687464905858424,262144 --variations-seed-version --mojo-platform-channel-handle=1840 /prefetch:23⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1920,i,11878869236967766237,1607687464905858424,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:33⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1904,i,11878869236967766237,1607687464905858424,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:83⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3516,i,11878869236967766237,1607687464905858424,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:13⤵PID:3696
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3752,i,11878869236967766237,1607687464905858424,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:13⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4420,i,11878869236967766237,1607687464905858424,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:83⤵PID:3612
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2804,i,11878869236967766237,1607687464905858424,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:2668
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5072,i,11878869236967766237,1607687464905858424,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:83⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4776,i,11878869236967766237,1607687464905858424,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:83⤵PID:1092
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1016,i,11878869236967766237,1607687464905858424,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:83⤵PID:4660
-
-
-
C:\Windows\SysWOW64\route.exeroute delete2⤵
- System Location Discovery: System Language Discovery
PID:5000
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.0.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:5200
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.12.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:2824
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.25.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:1288
-
-
C:\Windows\SysWOW64\route.exeroute delete 0.0.0.0 mask 128.0.0.02⤵
- System Location Discovery: System Language Discovery
PID:5168
-
-
C:\Windows\SysWOW64\route.exeroute delete 128.0.0.02⤵
- System Location Discovery: System Language Discovery
PID:3632
-
-
C:\Program Files (x86)\TurboVPN\ssrxray\ssrxray.exessrxray.exe --xray-config xray.json --ssr-config ssr.xray --auth-type 81922⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Program Files (x86)\TurboVPN\xray\xray.exerun -config xray.json -format json3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4416
-
-
-
C:\Program Files (x86)\TurboVPN\tun2socks.exe"C:\Program Files (x86)\TurboVPN/tun2socks.exe" --tundev tap0901::172.31.255.2:172.31.255.0:255.255.255.0:172.31.255.1:8.8.8.8:8.8.4.4 --netif-ipaddr 172.31.255.2 --netif-netmask 255.255.255.0 --socks5-udp --socks-server-addr 127.0.0.1:26885 --loglevel 32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1792
-
-
C:\Windows\SysWOW64\route.exeroute delete 138.68.135.248 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:6032
-
-
C:\Windows\SysWOW64\route.exeroute delete 138.68.135.248 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:6140
-
-
C:\Windows\SysWOW64\route.exeroute delete 138.68.135.2482⤵
- System Location Discovery: System Language Discovery
PID:4452
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.0.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:4520
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.12.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:1868
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.25.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:4564
-
-
C:\Windows\SysWOW64\route.exeroute delete 0.0.0.0 mask 128.0.0.02⤵
- System Location Discovery: System Language Discovery
PID:2072
-
-
C:\Windows\SysWOW64\route.exeroute delete 128.0.0.02⤵
- System Location Discovery: System Language Discovery
PID:3408
-
-
C:\Windows\SysWOW64\route.exeroute delete 138.68.135.248 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:4932
-
-
C:\Windows\SysWOW64\route.exeroute delete 138.68.135.2482⤵
- System Location Discovery: System Language Discovery
PID:3880
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.0.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:5888
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.12.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:3528
-
-
C:\Windows\SysWOW64\route.exeroute delete 10.25.0.1 mask 255.255.255.2552⤵
- System Location Discovery: System Language Discovery
PID:3980
-
-
C:\Windows\SysWOW64\route.exeroute delete 0.0.0.0 mask 128.0.0.02⤵
- System Location Discovery: System Language Discovery
PID:5424
-
-
C:\Windows\SysWOW64\route.exeroute delete 128.0.0.02⤵
- System Location Discovery: System Language Discovery
PID:5920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffb9e73c728,0x7ffb9e73c734,0x7ffb9e73c7402⤵PID:5840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1776,i,1950661905087363713,17426082558714303623,262144 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:22⤵PID:444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1644,i,12067920109709718677,1351455798233872023,524288 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:32⤵
- System Time Discovery
PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,10852615104219978905,15707892379250764781,524288 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2060 /prefetch:82⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,6918294206896228987,10389247210251510962,2097152 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:5556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,17192399512824437048,1222646435789624236,2097152 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4420,i,10447548194823197003,11458736431761670876,2097152 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:22⤵PID:2800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,3542822735371813644,18332131172296865351,2097152 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5072,i,14471323350096637033,2425603983200416263,524288 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:82⤵PID:5792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5748,i,18088272193478131597,13089831341448875273,2097152 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5784 /prefetch:12⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3228,i,2482182084321344367,3711165218421169688,524288 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3464 /prefetch:82⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,3332204439213259249,12244569213302667481,524288 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3248 /prefetch:82⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3432,i,14022462505097989922,12586723361940855799,524288 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:82⤵PID:760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4536,i,11233715571838262314,6153617985768781594,2097152 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4476 /prefetch:12⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3352,i,3958299026907384060,4049822923895793352,262144 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3428 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4880,i,15481805640888494855,14730290573824536461,2097152 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:1320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4908,i,9627440744096361713,3430738345083743577,2097152 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4528,i,7636616728864455217,11423901743578279255,2097152 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4532 /prefetch:12⤵PID:3596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3252,i,11799365184197069780,13617297426728769183,524288 --field-trial-handle=1996,i,6869699893521156615,15673618121795333179,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:82⤵PID:2380
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4928
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:5668
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
2Install Root Certificate
2Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\TurboVPN\WFPCAL~1\x64\win10\PiaWFPCallout.sys
- Size 36KB
- SHA256 aa643d82a931af1ed72f5e2839cb16e8ce2c35e64e1702a53b8c50ab2754421b
- MD5 301ae23c828862a216767eff6c3ea210
- SHA1 676fbb95685cbd02250093a7a37b7931f3f6c3ae
- SHA512 9022fe60840d81b16c3073e2bcec7af8d0a06df6fe45f2d93ad5f4bf747b93ae1d12800d0f579d7308b5cf1f45b0b905bc8b706970fe2f396f2f06cbb0d991eb
- SSDEEP 768:/ebma1sFKqB+oXxX3Zbk3SeAMxkEjijW3IDuO9zi1/:/AB63B+oJbkisxHDOzip
- TLSH T185F29EE6C26428C2DE1B5D74A1D0D917BE7473871742C6EB0274C1610FA37C6BB392EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\TurboVPN.exe
- Size 6.8MB
- SHA256 e99d6a42602f47c06e3134d7afbfa4ea1738061c4a164e3d83a19a05eeed2985
- MD5 f8e1bb2dc2b5de01a8b38e277c07a068
- SHA1 aed692f51d2e0ae3e862ee027c63990d80ff7b3e
- SHA512 4603dffeeb2ec5800bc198bcec1b8f3284ad472805c1815ec5d0a4b94f8335f4e6ab63df125db7b4457586cd118df71e4ad2d920ef50397f1a67779228dede6b
- SSDEEP 98304:zGd+fhXA3MtFHNio3jVxonU1iB+lyXtbuWjB5bBqaRqPfm3EBqdUBEuUEQZZJ5:zGdsAJUhisSjjr0Q6fm3zdUCuUEQ3
- TLSH T10276E062F605C472DA6951B1D4296B35E46CAB3F1B3008CBB2F41F2D9E306D35A36B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\WebView2Loader.dll
- Size 112KB
- SHA256 8c1b0ae8b7e7aa402407f00f22efb1989e47aeaa9c6a1ffa98341672d9ecf6dc
- MD5 33f7fa1198c0bf4988a0210f144b20b4
- SHA1 06d50e37389480f542c8e15ae2e85106bbe9c304
- SHA512 09905095729e37f00fde5ce967fb309c8e64c76bf0f6839fa27bede39b91d663684c8de05c16fda63699df73a78a23a60a367a5e9c56366d6c74424506a4454d
- SSDEEP 3072:TsaDUh9T2dO9O3ed9zJ11Xx3QKHwsTNOEt+AlLix3TF:Tsp9T2dO4o91OEt7hC35
- TLSH T186B35B51B6D08471E5BE09380874EB696B3F7A60DF608DEB27541AB94E313C09F35A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\WinSparkle.dll
- Size 1.9MB
- SHA256 8acfc9cc3df072b810b16207c07e05c343c182b23388695185e334592bc21ba9
- MD5 0cef6ea48cbedecf93129f8a4702b9ad
- SHA1 ea9145184eff4d5789dc672af9da717bfb168e42
- SHA512 b22989cd1d49dd46f7e50d2ddd49784b3facb1f007072225868221da82a77fb835a17042c4bd1a4b71ef4edcc279c8cb54cf4992f6f29660f0fa0bca1de5303f
- SSDEEP 24576:5jpgelFfeDGr5+gTtMlOGKhunqREzxvnKxSsKwCdEn4CBji7+PSwLFINP:zgaeDGBjYGgnxsKN6n4CBawLFINP
- TLSH T19095BF1375C0C43AE4BF03349A25B7651ABDFC700970C98FBB883A5D9E725919A367A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\breakpad.dll
- Size 511KB
- SHA256 1de83f6d5783d126910d88f21d9bf659ec995dadf7be4c573c8045d298f6e56a
- MD5 0712951d33bfa47d1a6c79a1228729d5
- SHA1 12720a6157df30271a641ef23bb57747b576d8ac
- SHA512 78970d722db6942de22ee10b3b4131d5edd3bba50f7d61228b70c7b265ff5b67899b1d26fdd56d975b233c19a1054f0bba5a75ee8d917d5d06f87c5a6e198e92
- SSDEEP 12288:yklU7Up5Yo+SmwhTcxMfZ8ts/JPOPxgTs7pSRf9Qb5ICEnXbr4t05uXZS924zpU/:y6AoBmwhTcxMCts/J+xgTs7pSRfHr4GY
- TLSH T132B4AE117581C0B2D17F01305968EBBA45BD7D300B6D99EB73C88A6F5EB01C1EB39E6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\data\plans.dat
- Size 11KB
- SHA256 e5220c78ebd5e30baee11b227f13765f6f6c7a461971c7041fa2f6aa6785a518
- MD5 ab69e71a03e2aa774eb643cb4a373482
- SHA1 1cc75e3890487d8d19d0f036104e1db59ec459d4
- SHA512 077838e1ceebdd0b382fd2f9041d8fddc8f8d5e7cfc77f9b24075e9e5e256c9fdae5b77be69ba79e069f9a762cb9e3baf153b157341c812ea22d73a99fc22552
- SSDEEP 192:sLTuimPFBOijegz69cHctxXGjYLOzy6cF8R/S6Apg7cffsI6VnbsSHGS3kwNuJ6q:s/uimPFUwjz6mOxWsLp6c2/87kfVb5mJ
- TLSH T16E42B0D805F9AD548DB1233C946FA64FDAF12B34C03C7278D82467CF904B691E859EE9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\data\proxyIp.dat
- Size 792B
- SHA256 9039615480b25fa6625fec9448772e6c4084d73ce545ee65ab461ebb19e6c008
- MD5 b64bf20d335d4790f38ab88241bfd91f
- SHA1 7731e94f2ca1bbd46845515dffee9b6a58909375
- SHA512 72cafb60522eaa5e65f41b1320e9fa7328d595a908f59300be95f9875c6db05e851229840c1611a1725619345344c9af30b5713c6a37315eccfd3d8e90ff84b6
- TLSH T14E01FD291F12DCBC4B86B0CE3CACAAF0A4F11CDA985C8A96A681AD509677674A6801C4
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\TurboVPN\data\remote_config.dat
- Size 14KB
- SHA256 52861bf29f8b6116e39337836f14ed162229020eb653bd46349fd8ea1b3cfad4
- MD5 1b57713c633e5928629ff71a135bafbc
- SHA1 f36a9f5b0f0843505e0dd4a8b8e7b964b213a568
- SHA512 42a880b09907bd5f46dbee9da10141258689daa25d4601a49245130aa8df2ad4d6a26f6df614e19c4e07c35830a7f8f6de19105ad86eac054219e5ce2617cece
- SSDEEP 384:bEMEV50XQuF9boV+oZYQjw2MoSVsjSdHhiRSd62Z356:bEHV505LkVr1jw2qeTSd/G
- TLSH T11C62D19E9933EFCC54CCD5D418F140283B59E952DD4245A5629C483A3F6CEC3F96443B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\data\sdata.dat
- Size 187KB
- SHA256 c9b51ac0bbcaafb2afbd3c843b5c5310775375e5cf02ecffc060bbb5b695b2a8
- MD5 3912e3d9b809528b3e9b65091e546d71
- SHA1 61340cb5a2959a4f6bac041061e18aa38f35c5e0
- SHA512 4bc323366a97b7d2b48b4b1a6e61dd2d76e1bd7dcae44411c881f1a3731847f8c0c41f8b7c32169c2177df722d106a14f2323601aba6f34b162bf32f9a8ad1fa
- SSDEEP 3072:9mSzdczoiczcjt6aE0RGvTQjxcoZi04BIxe09Pk1GS7p06cLEHBwLh0PIixUs0tL:91yzys4aYTQjxeII0PbuzHBICU3GAeiV
- TLSH T121140223C23DA368B70EA65B739D3F30FDB0842B8DCE69D5B8147485A6D5079097BD0A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\data\turbo.cfg
- Size 31B
- SHA256 4ebacaf3887a78d694a6fe15b1aad8bad2ce5e5c87a0d30d6a09b185eb9529ac
- MD5 82ddb92de0a62d2a1fd6b45d9c92d068
- SHA1 e5a90baeafdce7b7ee21fee30809624f7a666317
- SHA512 153111a81311cacf849709e193af92109c42fb4d02da0ccf4362191461304bf87aebffb8e0dd64d0b627f483480efb415ba220d0583c6dabc4543b95bdfb1ac4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\TurboVPN\data\welcome_page.dat
- Size 12B
- SHA256 3eb241ebe6886ef260b7f9a0b95952740dfe7a3b4d7f2f7ea336d9df57ac78b9
- MD5 fa4c8a319074c394440149922bca6e4d
- SHA1 c6e9f25d2ee37dc45c59645934de96d75d9f6053
- SHA512 81c902b1c1033d43695948a812b43a775bc2572bf6a3470345ff1e1b519c835dc7a606c77a610aecd3fd3f0e00744f14ddc7c5cc2f861c78c6353218fa62ed24
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\TurboVPN\installtapx64.exe
- Size 150KB
- SHA256 44a9c1d18615fbe62107daeceafbbd7ed3b98a87e2cfe88e33a222f69b9d613b
- MD5 11f68759aed1559a9d1b43982fc7a455
- SHA1 e7132db9bfa6cce5cfc8c2b2d1776c46e8d215c9
- SHA512 535018e4e115a826e9f146170dc3fae20421ef2db5af34ec358dfdc45804a1fb7a91c9312e97201a557ad2fd86c6281516a7dd98cfc371d3143a3d0ff0065706
- SSDEEP 1536:ByzaYrvAeTy+J7x5UZ/5d/kZJpqjfS/B4R6nE5qCyCS2K4EGawqiNZReXXsWXd0F:CG+dU55RQp0uqR6nEbkXrMOvKmISU/EA
- TLSH T1D4E34A57B3A530F8E4379138D9A15A46EB7278760B708FDF035446661F27391AE3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\libuv.dll
- Size 287KB
- SHA256 77588d049f3fe0c1aca73d3e560fefe18a620943e0405e71d1bf786cd6b26a9e
- MD5 9f168f908e64165f280d79e70279b45e
- SHA1 8492f09cab091379a25d8647458b754d082489c1
- SHA512 9ada7fe2957bf2cdefe2150b1724e6ff7535b14397cd93c750bdcedb585023810f5034c0e6d1894383cf6dc03021ed4c8346321ed926358fbdbd45abaf63bd98
- SSDEEP 6144:RDr8zKzHEUzN4zyRxVbF1rMy+wPppXzzvE8m7h7Z51c54zEC:R8zK4oWz8xV7My+w/Dzc8Eh7D1c5MEC
- TLSH T188549D00F880C076D4FA043862B89BF609FD756817E5D4EBA7A466BC5A215C37339F6E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\payment.dll
- Size 153KB
- SHA256 e157eacdc4cddf45da0a86343ce27c7a42b835d1c2217b48b29bea0f12af29ba
- MD5 29e53d2824e245b93b887ed06c1b90ee
- SHA1 6b1924384be4fcd0e8bc5bff189f1bc33d276cb1
- SHA512 c5e68b222253a71ab69616004805dac32dea40e03158b9592380b3f2836b30287d1a2ed8ba6faed1529e1c93556673df664c28cbcbe15fbb7a3eb4b2fbcd87e9
- SSDEEP 3072:9eVEA5EkXLNoVMWM/Sd309tDa+9OahFR81wUW4uyuU4u2uqyblmb212Nu5huybBU:9eVEgL6ZIq3Ya+v8uUW4uyuU4u2uqybG
- TLSH T12BE36C117680C432D6AF193C59B4C6A65B7EB931DFA059CB3788076E8FB13C09F74A26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\rlottie.dll
- Size 691KB
- SHA256 3b1e50d81300df1e9a1dfed61f934a1c05b19f81175f35b136c55d69dd998cc8
- MD5 55c74d9833e68d48e195fa0acb49b971
- SHA1 6dfdfde23b09e7cb8599fd2e29e2d4508ce782db
- SHA512 bb31b363c78bae11d0f38c365665c3ef798f22fdae00b1d795e3970ba238ad9648589ae8af8f903de772ccecbc51d6a33ce66ba45ba5b1b759aa74db5011747d
- SSDEEP 12288:6Uqif4Gg/btF0ZI19ZcvQtfPJkY5jQCZiXycEXX6vcD54O0qMIMDcDL4aQyMDUJy:5hfCn0q1MALP2/dN0RaRkY
- TLSH T1EDE4AE107443C035F26E0231593DBBBB59BD79524B305AFBB3E48A3D8E304D25A7AA67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\ssrxray\ssrxray.exe
- Size 390KB
- SHA256 50cec1bf23fbaf8c93a07dd3ba7a31dd612c24de867992f533d9fc9c26652e01
- MD5 277f541f28c927d03d205db907a824e1
- SHA1 5594d49b289da6fe2266f882a6d41d94c8a20b29
- SHA512 6a1e797af2fe33cb66708db2e32496d61965e4cb99985c9931ca2feb50f569e3c4d924182365c4dc02e4b493c78b4759d65c40fadda459c6760a5f28800f8296
- SSDEEP 12288:Vxpqd0XQ8QPj/bVdqSgffmsQWxxaz0hK1j7bY:Vud0XZQTbk2sQLzaK5k
- TLSH T17884AE117581C032D67202301E38EFB699BEB9501B355AEBB3D84E6D1F742C2A935B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\temp\9b935ccddd9945fe9a1db317ddc2315d.zip
- Size 1.0MB
- SHA256 05d91b0be80b50cc36aebca2b599eb4eb3ae8912ddb9ac718e801143969bf0a7
- MD5 9b935ccddd9945fe9a1db317ddc2315d
- SHA1 1fbb3cfc5279413f3f1903431eb965440f37b5e8
- SHA512 183eefbfa789fa508062d82c646c2f3478d5e887d6a020615e72df78b39a41f23d6b1d9c3eb5ad917c99a7a34203445bcd87ff76fa951c297095f275e191f9fb
- SSDEEP 24576:EEFrPl6FAmez0X3XEr1IMw7jtw56a4Q25gC:fRNkeoUKT7j64Q25gC
- TLSH T18235332994C5E851F1F6E577A3520450DEC04F892792B1FB76FCA73BC80D660EA2DA83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\temp\f7757a77dd18d0446f68f2708b6fa3e9.zip
- Size 128KB
- SHA256 bfaf873d5907e73d09d64cec3699a34930fe20bde4edf66b58da0cc66e34484a
- MD5 f7757a77dd18d0446f68f2708b6fa3e9
- SHA1 0ef2358ac99958dd1c86b65dd57601a73c190be4
- SHA512 f78d72dc1249e21e73045acf1be8966337abb8ee80b7b010fc410274fbe6c01e4089fb546634fc50cb620298e5a02c94342af8ed8eeff6568f0560641ee41936
- SSDEEP 3072:KqYDgJcJBx1+cfLicj3+m873FFB38mjvISt7M:bYDgJcJBrjWcirFFH2
- TLSH T1EDD312BAD6E630BBEBD73336D062A12CC4A30A05D73456D3750D607B782E4E96B11BD2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\temp\mainbanner
- Size 158KB
- SHA256 f7080081a99291e3620622938f67dc287c7c6e48c615de798c6d1579e6dd73d4
- MD5 ab492fd11584f1e8df7f46a5c55bd9ac
- SHA1 daec3df9a14fb26a89f542a4e1675243ae8e854b
- SHA512 4cd54d9932d77cdd6460ca267f67fef91464b53bfc06b5b98a6f96c3a5ed10f16ffcf8cd67aa7a6eadca8a9112dfaf877990fc30f816bc39ae8371ddbe49afc0
- SSDEEP 3072:OQm7MCLQm7MC0Qm7MCvQm7MCgQm7MCkQm7MC9Qm7MCGQm7MCBQm7MC2Qm7MCoQm3:OQoQFQwQfQbQWQRQCQBQXQW
- TLSH T1D2F3C0CFE4FD88F4D67AF97D23E509984561AC29B3487B841630899D75CBB9B06C8EC0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\temp\mainbanner_patch\banner_en.png
- Size 37KB
- SHA256 8763e18e180133569a7c8c357b5a8277f5507e2515a55a4da78bbe124df5e2ac
- MD5 c6fd9534685491d610b23fb2ff0b2686
- SHA1 e103fd7a3cb5144cd9ecf40640499210f4468fd2
- SHA512 76ba5b4d21e5dd5b8fd29d9135262ca7c720c1c12e47415b529f1cc31696fb380f35453dfcd37855dc4dec0b07f0a9d8b72cf84009b1c8e8a3e081a786af3aee
- SSDEEP 768:7JtQW/eqqLzvIHo2/j+TzfggZE+dYFc+1saLrl4z3T9:7Y6eqY8I2L+TzfggZE+dYFcMyd
- TLSH T16303F1F67C56668C9CCF37129C6FD55CDA309A218A74F2AB4BB47019CB691E6112F031
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe
- Size 1.0MB
- SHA256 64b010c1534527636d9379a704f1241870349971c27f33c97d4c2761c949256c
- MD5 0bee4138e1f17caf50f0c9cf10bfbc43
- SHA1 ed5ef7b5db78e1882ba11b988fd0d9ae36f55fa6
- SHA512 a2ff1d65e9763a61f39fda85a598c60cd4e41118730ffce3acb4ba081e4dfed9a494d75e5fb1b70fa17f5526e5adee6441b25c3e894c0abff33cb550c6d9f8cb
- SSDEEP 24576:dCbT7Xkk0D1ZKp2pDPs0Cft0Lt6QSuTkpECdK0K4JRHLB:dO7XqDKYpD0zSTkqQK0K4HH9
- TLSH T10C35BF207982C0B3DBA20570597DEB37453DBD290B249DCBA3D47A3D4E302E35A7967A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\TurboVPN\wfpcallout\x64\win10\PiaWFPCallout.inf
- Size 1KB
- SHA256 608a9c345449ae804e8434f31e2e7088bd67b3e008ab85137dd8e9b8ae6a3431
- MD5 38181dfce4f6d6e3ba95b44639579429
- SHA1 17d4fe9f29fb641e4f2bdd3aaeb8296f1d6a9c20
- SHA512 34ab5d0c607d8eee656a1974b6e9f9c2212ff161c61f7bde71b04c7d56e005bc3c0b9bcd302ca1ae43d9110ea86ee8d326a1af007c421e0591bb8a1d18a5ff3a
- TLSH T1BF31674929AA4FB834E2A7611E1B01C2FA406E447C69140CB2FF7044979FB0C632D2EE
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\TurboVPN\windui.dll
- Size 834KB
- SHA256 dc060550bf077dc1a21d75e2fb75a75c15bec0e1cd45efe173bfdf55fd8880b7
- MD5 dd326f26932a4fff881a735fdc7a1460
- SHA1 5cde8a60970d94e97969b398def13e3ec4661e5d
- SHA512 144c74930be6a04eb6e69710c7b7e4c6f22ec9c2288f73719f6d80d332c1ba7be8b340c206e685a80eb0225ad2188e5d4c2e2e083dfffe2289e1f0265e0b3d80
- SSDEEP 24576:12kf+5TSwLL/tO4cMZClCitv+9fVSE9WMp:12kW9SwLZBQlCvdVrJp
- TLSH T10D058D217D48C135E2990171987DBBAB407EAD250BB4C9CBF3C49D3E59202D36B367AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 7e756d502c88b3677e034bd1e914d0a016d24c0daaeee539b1b8958c02d39ece
- MD5 316ec8fb05f990eda78daff2d0f7eee9
- SHA1 d53cad5c2843bf145e66873a0def3ca12215eba4
- SHA512 17d2e49382ec7cb66e4d29770f42965b18c2b57ca51ca88a6a83fe77507486822bbd3da69e70c2c4374920b09af99b8e2764665566e2413845a7a109c798dfde
- MD5 SHA1 SHA512
- Path C:\Users\Admin\.TurboVPN\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 fc225af3266b07cb825dc89e07cbf809ea1bb65019f5e23fe70577ca9aebd452
- MD5 46acc3138b5aab6d57b308afe1943858
- SHA1 921b84671b7fd40c02b511ca311bcdff37974014
- SHA512 7e780c396809bc63bb7a1c79c8b9c336ee8d257db053f18020584a38915702b6fb94c41f230a3518050956b9a5a225334a8612277cdbc929d63a2e4d9d890474
- TLSH T1B8D0112332020E38C02030332A02B20E0C02C22F800E8202A82C8A2EAB280A80E02882
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Cache\Cache_Data\f_000009
- Size 331KB
- SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
- MD5 05ef8155cf66131654d3bb9c9cba5853
- SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
- SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
- SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
- TLSH T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 fcf00ffe0fadf0e3b81c8c7bb3c1ea0aad0b993775f1f28894eed3d215453e3d
- MD5 44687c10ac4fdc69f1f61276ec57a2cc
- SHA1 dead865613e53a2d6c10d239659bf818b060cd90
- SHA512 b5e4e82fbc0227f250bdb72c35c12c5dcefa2dab81ece2d3b7405f71efb9bc166eb7446f9515a6c3123f939c6ecd0e75f63ea703c6fe9c88e0b6aeb8a7505615
- MD5 SHA1 SHA512
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 528B
- SHA256 76401bf48066ba086bb0eb75f995aa5663ae1c9e698421489c87bcd73e05be3b
- MD5 63fd97f5d402ee10df74f3a5df9a3108
- SHA1 52143c8ddd2fc11e135c2844bd87500be6b4526c
- SHA512 0fa3fafa929c657aa1ea5ea4ccd0b73d1963ce70787d9ef12dd6e8908b5988b7e737973de68f690ce0df3bcbf4d05e527daa76d64ed6f63f0f1f4492ebb9f642
- TLSH T1D2F0686D4D700A01C740E6B65AF22D47BF320D1331533C2E67C91DB1A310300468E400
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 768B
- SHA256 33acbd6a9d1dd3ba3ad73a0887eb418f1cc70b91fb00c73be70438ac62003559
- MD5 b2299fe7d97e1c4588800d937cc5166b
- SHA1 d3f5f74c555d16eede53256c0b3ba0eae5f79e3f
- SHA512 0ce030f500f6342abee1f0df40b50be87e8aa079d3706fe6af8e3161d3d3f62487d1789a457afdf97fd15b095cc0ad2064d11418af989e69834ec261609f0202
- TLSH T16301228CC1B50EB2CBA4D3F30AE22C527F380D0325477C2EA38A5FB1B20A75042ACD45
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 792B
- SHA256 1248f827fe42de91e1bb16bdf40a0001c910723e640fff88a4050f8e457af87d
- MD5 3e65a9e4767c06604613e4453428ebb3
- SHA1 f163cace0df47851f935db9c4b2da92301bd2f96
- SHA512 92fa6acc6925d3eec3a760b3c18d5bca5577dda140dd0217f045bc283f0aac0e6ed868f5b847d23885808ce81bc9888bab210ead0fc7cffa16608083e370c37a
- TLSH T1D401448CC1B40A72CB64D3F306922C026F741D1325473C2EA78A8FB0B106760829CD45
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\Network Persistent State
- Size 87B
- SHA256 fa2ad76b2754362ec9a32c24a767d7739b3de717f8f28f786997d6da0ea50853
- MD5 4664a2ce60135af283c508e03ff05d37
- SHA1 b2ca7b306e58588f3e73ca5bd5ed15577ecc635f
- SHA512 2e10b4fb34b859f5f3755f0bf2b3a010513765d782b128ea33f574e8db0bb255ebd22c484fd6122ea864f9bc3485c6709f416f03a80ea07a51463f666448a5d8
- TLSH T1D5B0122A58312D880B4743902718B40B803B0405220883BCE43C7BB841550284C1CC05
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\Network Persistent State
- Size 6KB
- SHA256 a83e1ef906c557c36a48f2ca6d4e7a7178ce9580396f9f107447222d165584f0
- MD5 cd7557c6b4ba38efcce8f99703d2b6a9
- SHA1 cf676deec3af78e669ca9f724aa6deb3369d9d4f
- SHA512 442530b40f7e5ad779f460072ecaf2905a33334ca84383b57a8eac485c644739e0172bb7ba02cf2eafca1de352e41aec7a6646b797038939871023e698107238
- SSDEEP 192:DNeLSBPe/ZSa+YE/+DL78cR1mvRVX42iWNdtiKn2d2n8Y:DNeWBPe/ZSa+YE/+n78cR18RVX42LNdB
- TLSH T163E18AE3C6F86A3D8C6122F42A25791BCD5E0D1457283E5ECDE9BB9B97D00A0D70294F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\Network Persistent State~RFe5e1b46.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Preferences
- Size 7KB
- SHA256 7a25321f3b152c8555cdfd55ecfee07305d3769b76a9377391e495f4ef748c44
- MD5 a348cf5d3c4b6bd026eb1becb2b28f96
- SHA1 2ca7eb2fff09c1fefdd5a0b63745f70c8f30ffb5
- SHA512 b34bbf4e75322c7bf2594a8e5d6fa1373887244667141941a77eaba2cb05316fcd625b08380e320300a86931890030fc7df93f270e551127ff6cbace8651074d
- SSDEEP 192:stc0fAIvkfNZ8paag/S+WiqA8wcIsXIHYdAVIg2W8+ZPlqMC:st9fAnwO/VGwcjiVhC
- TLSH T15CF1A443AA6429BB4DC7E629B965F727D2F7012265D00EA5EBFCC51C04D7ADC620390B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Preferences
- Size 7KB
- SHA256 17f461793c48a4aa5b8d86060608183cc32834d88916be3c4b336b1d03c42b97
- MD5 83915c814929baf826d4045f14ad7254
- SHA1 9eb94ab57a3c26d4303d29f38e985231a0285ad0
- SHA512 724db946e6db274193a25e2d201678423062373b5cdcd329bc4a884bff57bf4afbd70f9f6ea1896115e5c52dbf2dc039378a51f55586d8674d0bd2fadeef4d52
- SSDEEP 192:stc0fAIvkfNZ8paa1/S+WiqGeQcIsXIiVfcnAVIg2ru+ZPvqMC:st9fAnwr/VWQcjvVaC
- TLSH T1A3F19453AE24697B4DCBE629B921F727E2F7012265D00EA9EBFCC51C04D79DD610384B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Preferences~RFe5dd6ea.TMP
- Size 7KB
- SHA256 56579c18317c6b536e7294cd37527050a89b54540c25520c702748b810491286
- MD5 7e9e4d954280d12d90ed0d5a295cfe4c
- SHA1 877db9e353540b0becaaa165c508962cea896844
- SHA512 a2d913e1f136c371f8ffc36e4e9328b98cc2a44e814909b1c29ea96230dc2ea77fb4974a4b0900d6f0155bd566fe989cbbc50516dcfdaa3d4926d0362fc54b64
- SSDEEP 192:stc0fWIvkfNZ8paag/S+WiqA8wcIsXIHYdAVIg2W8+ZPBqM8:st9fWnwO/VGwcjiVN8
- TLSH T14AF1A443AE34697B4DC7E629B965F727D2F7012265D00EA5EBFC851C04D7ADC620390B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\.TurboVPN\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\.TurboVPN\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\.TurboVPN\EBWebView\GrShaderCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\.TurboVPN\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\.TurboVPN\EBWebView\GrShaderCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\.TurboVPN\EBWebView\Local State
- Size 1KB
- SHA256 aef74aed0145d001abcc6a14cf4a5d66558188ed1697b3164cf0fd37a7d3d042
- MD5 dfa5fc32c1d5b74699a4e76acb085ded
- SHA1 13cf18e12a6aa03e8896c51f5429277d78f3345b
- SHA512 c90eae33587683e5c3655e4e1ade6d9a48ea12b32ca6f9016c1553a0c0fdb62ec9728b4ba4f2d54bfb854d3e9083348c23ec431b901185f8f068cfab175e6eee
- TLSH T14431C7B2E090373398918189F2466B572E721272E1915E58A2DC0B0C02E759C973AD33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Local State
- Size 2KB
- SHA256 f65744a17dd451339aee98b2561a1060652fea03a48b61206d7005abb75c7807
- MD5 42826365be59a8bed25aff513dcd4153
- SHA1 6df77e3427f0655d647e97ddc77685f8ad99fba9
- SHA512 8e081f577ceb7824d8f8a9d10851f09daf268dd8674021b1e5bb2f8314ec3df443d882fe1c803c15985f62cf84fd45d2b46d0469420e7770646d7642d0c1e2e7
- TLSH T1D751B873B404AB37C5E38548B94A3F239A775271E5912F6496DC1F0C01DB55C2713C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Local State
- Size 3KB
- SHA256 b85913a057c98057b1283feaedd7149b2219504291fd211bfefdd50742496109
- MD5 4d365b6e1c265e3f09d1f769a7f1d8ba
- SHA1 14ab917a47443b5f2e47d9a523dffa16a94ac52c
- SHA512 bb5611e8514594c12cd35c6e7fdde097bd7bab121b0ae02ed78e87840e58f79142bcab0c69c3398994bc8dbd977b101a143032496a958f1f23328619f6be2361
- TLSH T17971B676A464AA378DF3C948B9C62B17B6A65233E5D53FA9CAEC0F0C01D729C1312D17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Local State
- Size 16KB
- SHA256 7e3814c20a7ab65d15febe2928c1564ff0fe5ccaf179a80669adc96780606a13
- MD5 13bd1967b0189c0a5051b59717f896e1
- SHA1 c95574e86eb1106c51cc2bd35a8863516d818db6
- SHA512 38fcb16ca5f63139c7e584249da37a12ca1bc90e251223eb0129aacbf0d31683d29eb2be45feac25c1faaeb3fe1e7d016f014b02482fc34a0e3c03907518de25
- SSDEEP 384:zD+aQikB+z/xvxjg/qhEwNbqy1fDpsRn9zn:+/UxvxjgC+5yL+nFn
- TLSH T114729D2B51687E2799F3E6057A4C075BDBBA85B290C16EB84AED5F0D06CB3DC0303E16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\.TurboVPN\EBWebView\Local State~RFe5d39cf.TMP
- Size 1KB
- SHA256 55508d3258f31bc8333afd690fed1da8ab00f8d0515a9ccf8e2a3afa4a3fdbdf
- MD5 7313d5ee915bb835e1aabdae8ddd1109
- SHA1 63980f4c5ad51fb61cedfc566fd2b2a962b2ad6c
- SHA512 8de4d8ead747421ba8445af1288c3a7ac603dc5eb0fb27567dedfa5a01faef3945163c36006f853d4cd1350a5262848ac116ab07d836c2797bceeda0afa4e8a2
- TLSH T1632165B3D094377295914089F243AB872EA25276E1515E1C92DD071C02E789C8736D33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 18b8335eeccca3942274002246df5854e28bbc4f95e2d013a5d90d0c30bb7f5b
- MD5 c5bf29a68fcb1c5a3b549ff6f701ea58
- SHA1 1a81d2d9392f26ccd30c56b3f8a1980fade80370
- SHA512 e360ae2f77d8653c70c07bcf3c0c2d11bde1639fbe693a146628935e4e7dc43225531c4a04e3a46ee315bbb8540a6e35e1c4da33909b08c9b34c97938f6cda9a
- TLSH T15FE022E5C821EC2B08FD072CA060074AE75123672A40CD0B3E3E860D8FB067E9581A2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 288B
- SHA256 a4b581640aa2dfbd7579b8c7b7743f0a2ec763c9658bfc004726f9345f0cfac0
- MD5 bf5562e5b5766b6694e7661b98d37f64
- SHA1 3c3f7c97a553ba9061cac2cb91d1c727aa1829fc
- SHA512 ea7c93f66c39d6dd1ce39e2cca185b92ce350e25698e94f0a2107e21531890849a38263b6fc93826bbd6d6010765bdbd0714ea2cabffbb7778d93280f7504cfd
- TLSH T107D0A71981F04AF5EB48EC7125E2043613651A3B63935ACE9086BEEE78E3B9F2602454
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 768B
- SHA256 cf4634ed16270561ea600c2f994612ce1d693b2d5d25316169e3c6cbdf8d04fb
- MD5 3005f4bef7fc2955a2a99c6f7a90c798
- SHA1 e72e4d733c302f72f8ad483846fb90db75c87af8
- SHA512 8682f8c791ca52469daabd10fb8d64a225016ed49e0fa5b5d17dd98369e7910212c82cad5dabcf38f971c9aeadae841c54c3a313194a57f33be12462769e0390
- TLSH T1A001220661F0CA66DF48D83119E9DC213279295B03838E9F4361DEB8F5A37D3A240640
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 144B
- SHA256 6c47dae3badbb7c0bb70616adf0ff0a2dd2f87e1eb56b5072586aac8ee9febb9
- MD5 3f26ecc7d60bc3c857ce14474a391a0c
- SHA1 b274cc7c7ed9656a7d9066594b5b937d788c309f
- SHA512 effa968dc8392129c4a5f39a61199b05686b06d4a656b8618e9c285d926be1c8861e172e750b91894bb8be72dc81f034bba1f13f7b9e47c6fb27f5160362e073
- TLSH T130C09B58D0744C55DB2D65715572000153705D50618395DFD1927DADA8A7554471B840
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_whatismyipaddress.com_0.indexeddb.leveldb\MANIFEST-000001
- Size 23B
- SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- MD5 3fd11ff447c1ee23538dc4d9724427a3
- SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
- SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 3KB
- SHA256 7bb40ceff94055fafae1c9185075e1f87f6ade1cf86440ce6ac83f29b1b0ac6e
- MD5 d2662ba60fc989909d4e1a2f62a7a18b
- SHA1 f4355e26cd030800bca779953f5b05587535a8f7
- SHA512 ebd2fc6785d7cbb2df4cfc43fbacf23be9588c073e18c9d57a29fb59cf9dfd4486d1255cf855acf57b99671770eeaf09b6df191117c8b5d565d968472696cd92
- TLSH T16A615BF7C3E8C62D894196F4A7156F1FCE291A24532C3C67C8D9AE5B93E2872D21064F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 5KB
- SHA256 872f50d1a47cca541f8e0a8dae39b868f743018a6437078bd2a3755353dae0b6
- MD5 727d69de0545d77a858af181f3691309
- SHA1 20eb4b7c85bcffe7f20f3a4544cf47e153755e4a
- SHA512 879522e86de78d93a3a150f68564b274e8e6fecc0fed75a2f8058867e56beeb7390ea4781f2aaa23b95f443d7696bc9863c64267f7628fdf185b1d0172ca3085
- SSDEEP 48:YALlhZhgtMhjh2rhzhtgHkkzaXYfoKsvgmzs7fs39KsRqzs+osYvqsbtscJzsj/4:DPStMdwrl3IaIcce9feIvF/sTxK1B7x
- TLSH T14CC18DF7C3E8C62D890156F497256F1ECE2D1A24432C3C6AC8D9EE5B93E2871D21564F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 11KB
- SHA256 a97988de51e9453f550e7009130de396f5b45afccdb9bbe937c61dd3ee2bc623
- MD5 ed9e7a45ddb560f7c3fdb35e811f34d7
- SHA1 02326dd1af9fda1740f77d859e58b7f3474eb399
- SHA512 208231aa1879e6b7c2ab9444c231807f3342ee702f21012b5928b4f6f9f8a19248239bc715b89e33e4ae7f152a0be32f9671fd19740086dcb935e27383e7f238
- SSDEEP 192:DPpdwrl3M7o7z1bcZA2aIcC7/sTxK1iK7cDFYVS7Jz8Q7lCHDaCEbNQJBTFx3n:DPpdwrl3M7o7z1bcZA2aIcC7/sTxK1iG
- TLSH T1BF429AB7C3E8C63D995259F09754AE2ACE2D0958432C3D9EC8D4FE8B93E2472D60174E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 859bbc9de5b016ea76afb4e50867d8e9662e926a7e8bf8d2b17c55dd51e85a67
- MD5 64e43c8edd6118fae0a5c36bbdee58e1
- SHA1 c7723445a42388308fa615b4e763fcecd7d2d20f
- SHA512 e4e42804a54bac4b961645e00c094695377fda9f0f30efbc861b207ae0ef7804ac98bf5fd24fc50e55b82c2afe39ccad3f81cf573252d048e9976aa3874c267c
- TLSH T1764158B3C6E889AD8A0156F4B6152E2FCE3E0E14535C3C5BC8D4AF0F93E2971D20058E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
- Size 1KB
- SHA256 1a2085089b089a0dd9d17c4bd4daa8c8414443219c31fbe79e0c87cad1ababee
- MD5 4b5874f313b098fcc3ec4d21ef8330a8
- SHA1 5448a3d5ed3661c9095a452dfe92116ef809ffb9
- SHA512 f2959734755e9223e908fa0476fd8f13122d5c8013f66a98407f547f5dfe1451a88df9428c53af6b7a00da6bd2cf2683c548b856518258dc517632f3fffc5b8a
- TLSH T10D31BEA392FD7867116D4DB72E14780A15BAB43101C1A8FDDFA691BCA0C69FB0F16432
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 0bf1d686380fe8013dcfe3db3133b2910ed66e91215b57b21bbd98ce92602fb6
- MD5 eaa7d0b90bc542952446d6c2e158ea63
- SHA1 ef7f6cf005f80ba06cbef536b7b245550ac8a878
- SHA512 cf8310f82d81d5c2bfd5d91cc2eac4aab1d9b94ac74a0a07c1ba3bbe28d5eed99380917c6b22f938fb78d7c5228a230c3d54db51e839fb109391f3ddf38cd38f
- SSDEEP 192:ZR/+9br1lLTv7apAPRp2t9FHsb+WNnDR04s2IakwfVyIsnAUgtaJ:ZR/+9b/rmUXGzw90h2IaZ8
- TLSH T1CD42D62EAE14657BACDBC229FD617753D7F6103226951E84EAFC8A2C05E75CC322700B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 9a945b92654678bc78c6848599e1b073f55aea36b360c571ff0d878e7036564a
- MD5 5e5c40f1af536c500ba108f5e4dd9b8a
- SHA1 7a5d76ffc3ae353797825748d59eed5ee1aaa02a
- SHA512 46e739b4a661156159a08a104fd2478234f7d51abc3702a2b7055de39ec73837261ca2f1678d99b20884d8598ece7d9004af3ca195775016333d8de102a02daa
- SSDEEP 192:ZR/mcBz9br1lLTv7apaPRpPOiB9FHsb+WNnDR486cos2IakwSVyIsnAUgraJ:ZR/mmz9b/rmOXfzw9+cR2Iaye
- TLSH T1A052D66EA914697BACDBC22DF9617B57D7F2103226A51E84E6FC8A2C05E75CC3227007
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 742c50ddc147704c851c060acdafefae28cdeb7b4a90bf1836d4cb83507a2f7a
- MD5 3255ee0899d9a6dfb7d0e971413a7297
- SHA1 30b7dd2f352f2e3de5a406c6a151d97e02605e87
- SHA512 a903d8514ca1620971832c413fc97d7a743a2ecc9aab46b2cf594bbd02a9001466fb13d20719bc713458a9ee9d60e241f5092bc4ce8b21ab62dc654bfbee337b
- SSDEEP 192:ZR/mcBz9br1lLxv7apaPRpPOiRD9FHsb+WNzLwsDR486cos2IakwSVyIsnAUgraJ:ZR/mmz9b/hmOXrzwD+cR2Iaye
- TLSH T12252E86EB914697BACDBC22DF9617B57D7F2103226941E84E6FC8A2C05E75CC3227007
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 0cd701a3868f43ac40ea69eb0baf5e2e82da1f2deaa99a8e1c6e03b69bc8213f
- MD5 92b6088ee23e0a759fcf7527c3ab06dc
- SHA1 a8b0fc8dcdabeadee1dad8d07da14a2e6fb9abb8
- SHA512 968d5a222d9adb468fcd13a4b5a090ce358a0b252649072709cae75e0919af4e22525c37d6f4ac75264fa1d75d4ba2b1df2074483d48387433c51b2b2acfb3e0
- SSDEEP 192:UR/mcBz9br1lLxv7apaPRpPOiRV9FHsb+WNzLwsj4B86c3s2IakwSVyIsnAUgraJ:UR/mmz9b/hmOXtzwyDc82Iaye
- TLSH T1FF52D86EA914797BACDBD22DF9617B57D7F2102226941E84E7FC8A2C05E75CC3227007
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 28d839bcfb204efc07b4fd905c67b665b7ac963845fbb1076a952430e84c9580
- MD5 623df45ab32f98fe9333da65db20fa6a
- SHA1 3aca3990ec7e9c1a4e8ee01676e4e78ff050d667
- SHA512 9d9f6980470a8d4379ef5581e62ff9365b414f4ab44aecf1494a184ca90b2d36d560d251cec4e66f08d691dc5901d526c1e9510e08775f0ff1ff876d77a77b50
- SSDEEP 384:vNjzO7KxkXqKf/pUZNCgVLH2Hfgsl457pLuLcSjZkXODzq+ErU3p8L+HGyN423w3:vNzO7KxkXqKf/pUZNCgVLH2HfgsS57pz
- TLSH T1FE721A677C4C9A770F94C68CD8167F4FADB5025B61E9886443FA882903D5BCF114A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 60bb7ec7d73a70cfcac63931621c9ae69de90a6b667a689182db999b6b6dfe53
- MD5 9e2aa883bfd3562d985841a19a266b64
- SHA1 85a69ba1fcff85aade12a55743a4dc63df249a68
- SHA512 32375ee4db5820078bd0e9c57b700c2bde08b2e3de63a517ca11a0f3e477e6c2c364afe2bebe0dc018837a82b05d101886c9b635af460159de430930467e47ae
- TLSH T14AB0128080015201C01303F41156148871249F20961B170D83E47A268829191C014060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5eff8c.TMP
- Size 96B
- SHA256 981e97b0782f8771a2f5d15beed6b48ce08d69e1579a6107cd983eec14b64911
- MD5 2da8ef7f998dc4d4245dfc37bbe8aa00
- SHA1 09197c405b13c3c21fa0e55308da14c249c64208
- SHA512 41791c1815e165a57ae228fe09b1eb49dcbac42ca0ac90fa6b726463ceb6c8e79a0c50904f5f811c7cf0b1322f4c085eed8e391c8cd77f1ab12ffa4227b2a851
- TLSH T167B00265C1227296C0C217B12995A5D875A0DF39C643131A92F11A7ADC257606D6A660
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
- Size 96B
- SHA256 c754a348e05c0cf306d8d107e45053aff9a3753899b5abf05115da8321c7472f
- MD5 8c33c006b581deb29ae2783ee038ecfd
- SHA1 6b35fc6ba0f1a284a39e5d78675d91cca17401db
- SHA512 3d9225997734541f5eeb53748369a6003176bbd093b51a9683ae5b3851cd6999b68e04a0c50c35df4c2837e04558d6ba7d63e97b56d0e607e6380e6e97573645
- TLSH T194B0220020A82A3EFF0003F008E2C2C033222CA2328BC283BCF8C0C8AC0AA0083B3800
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 682417e8aea44db51e13dede5666fbce24a7bce058dcb89c8e100a96920e45e2
- MD5 39c7aee7cbaae177babdac9250762aa8
- SHA1 0c4e10e0dfd80fe3f34805b968156764d5ad44f3
- SHA512 91f5209b1cd84816b6f63faff274188e164e661c660d48e483055a64f6b521a1731dcb4d234348ddabcfd2ce2d6144814579fd4dd5ddec166228370b454d01df
- SSDEEP 3072:T6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMn:Zm7Rkm1tYpBeh2BAon
- TLSH T1BEC312275D71E97B59B9BB4EB08E0B1F1EF149A2C930DA52C8D85B0437F97C81A48D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 dcb19a7551aa319603ec09848d161002b7bc37fc84fe8549d5ea4bb3678afd95
- MD5 25bcf213eedcdfd55121ee742f9d4bb5
- SHA1 74068b44abdaef7198e82eedc29951c8327f0884
- SHA512 f207ca0df5eeab7e022f4fffdb0b47226aa1e6c29cb038c8d7f1798a534e8df33305ff803fd85b129445712ef39c3ef69d590d154925bcb2c4ee4ca808bf51bf
- SSDEEP 6144:I1hxNPRW2PYddqmY7U52Fim7Rkm1tYpBeh2BAoM:uXPRW4Kq97UA/9oBGcAoM
- TLSH T13D3423327CB4AD790C69FE4D308F2D2E1EF28ED69868BFC6C8D45F04266E9841856D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 84cae4d9aa818969cbf5908ff5caa7b3265fadc51e92a18a33edb629a375a813
- MD5 8d17041c2d6e09e0a16e2c942062c91c
- SHA1 3885cdffdaee65526154b9ee2f71967e9a4874f1
- SHA512 379177ae9792e5539daf1c0221aa07da03efc0abc25a4d0e68970628bcda4b2f753e6afd6b4ced13cc4fcaab4fd5800a4981409caf0de0213371fc17ec1116de
- SSDEEP 6144:3hxNPRW2PYddqmY7U52Fim7Rkm1tYpBeh2BAoM:xXPRW4Kq97UA/9oBGcAoM
- TLSH T14D3423126DB4AE394C5DFE1D318F2D2F2EF28EE494A4AFC2C8D45F0827AE9841855D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 a1dd99728825a4232d1e9909728dab41dbc2dbff99943c69027b973b4829e825
- MD5 f2e68257f9d4a668b7c63630337d4344
- SHA1 4bf03f35b90300e7ce10fed26418366f67d925cd
- SHA512 0f5d0ca324c5bee5b0c61a4a101124b6f1326694ef74fbfe3dd3995eea9d41ca618ee45a0f863c1f96a60208bb76999784b9c59b600922bf9a1bf5898de8e340
- SSDEEP 6144:qhxNPRW2PYddqmY7U52Fim7Rkm1tYpBeh2BAoM:eXPRW4Kq97UA/9oBGcAoM
- TLSH T1443423126DB4AE394C5DFE1D318F2D2F2EF28EE494A4AFC2C8D45F0827AE9841855D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 3b3ddbb109bad096e8003c6fba0cc63dc3312f7fd3c25135b650e631e29cca30
- MD5 92375a0275411f2d83c0f29d657f1f9b
- SHA1 fc59535be81edadfecdba13c06844c74575c9ff6
- SHA512 f0b0b59a7646712973eb40212b73f5add9a52b47bb66d934acd2902befd09fb96c3fb9c01e73c6cac1117cb2915f08533271ecf2c8e1fbe9690ce07a3094a818
- SSDEEP 6144:51hxNPRW2PYddqmY7U52Fim7Rkm1tYpBeh2BAoM:JXPRW4Kq97UA/9oBGcAoM
- TLSH T1853423327CB4AD790C69FE4D308F2D2E1EF28ED69868BFC6C8D45F04266E9841856D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 7752d0d05d1e9c414ad0a47b581a1e17931e6ceae5c4ccfb9957fe9d185d0e07
- MD5 828b65631c48bbd544cdc4e975c2342b
- SHA1 e24498b2c9195c617d2309b41c5f8f09a0cdc0e8
- SHA512 5976e85dffd54c1d9a26d8ae0f18ce9a76d5c2529e2f77baa0f30c3b9baf9035c9fca8e3123a48f612a128dea99c5f76ed9a164b08b85bee8d0e0436c358a7e9
- SSDEEP 6144:SfhxNPRW2PYddqmY7U52Fim7Rkm1tYpBeh2BAoM:iXPRW4Kq97UA/9oBGcAoM
- TLSH T1273423327CB4A9790C69FE4D308F2D2F1EF28ED69864BFC6C8D45F08266E9841856D74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi59F3.tmp\BgWorker.dll
- Size 2KB
- SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
- MD5 33ec04738007e665059cf40bc0f0c22b
- SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
- SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
- TLSH T1C351B72E612C0BFFC2963C34BC96795B1B6FC060A39A6328813FC5853C141B4233DB2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi59F3.tmp\System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- TLSH T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi59F3.tmp\myinternet.dll
- Size 1.2MB
- SHA256 b0c8016ceb917cb8edb457ec1a8256c9e8adf4ad6e2a15e7c7232a4ffe4ae1d5
- MD5 d10c117525c05b0e87f9d99132887fec
- SHA1 c6d14c8512b2600f312be24672049b2cd334bc4a
- SHA512 6d2a7506e4adc3f0ba69ec5b4e3bfa72e77c98f24b9673e21e5dc932d7c32e5362866f875d6cd16cecc9d1b8ff026dd7645c48c1acea8f8ef0f0ab73ab5c4b33
- SSDEEP 24576:mzO7VNHDy5gjydVvxHFfvOUJIsHEiEql5iJ401z0dU+6EZTNg:XVVSFfvOUJn+W5iJL+zZTNg
- TLSH T16455BF157C808032E6AB2174867BEB791E7D64340F304ADBA3D85E796F302D2663676F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi59F3.tmp\nsExec.dll
- Size 6KB
- SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
- MD5 132e6153717a7f9710dcea4536f364cd
- SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
- SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
- SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
- TLSH T1A4C1E5B656D909F3E41D00B83E31241F43FEE5260B7A03719E8B2AC61CD2AB6FD58791
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi59F3.tmp\nsNiuniuSkin.dll
- Size 982KB
- SHA256 548b7113ae115d936a790760a46c3a50ddbae6ddaf163e6510007d1c280a5488
- MD5 149cfa10b1d18a65e2d0407d1a5930ea
- SHA1 ba678e9857b405c434eacdbf1f322c75bd568db4
- SHA512 5b977dfb3ee61b5e65ceaf0f31b871b95129896862b17c9eb9690dd2d560830d2b16cb95ab729cf80a0c069a04052d43a0f9288756caf0958353346c05dc2c6b
- SSDEEP 24576:cW/O23c8rH6o28TSlATaNS5O3TuWpwx52+A7kZ/QZAKaaSzUafmUwIcl3PVV01S:cW/O23c8LAlATaNS5O3THq52+A7kZ/Qv
- TLSH T157257C11DA41A13AFDFB04F64D7F56BE9429AA31032450CBA3D49EAE4B359E17E31323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi59F3.tmp\nsProcess.dll
- Size 4KB
- SHA256 51da07da18a5486b11e0d51ebff77a3f2fcbb4d66b5665d212cc6bda480c4257
- MD5 88d3e48d1c1a051c702d47046ade7b4c
- SHA1 8fc805a8b7900b6ba895d1b809a9f3ad4c730d23
- SHA512 83299dd948b40b4e2c226256d018716dbacfa739d8e882131c7f4c028c0913bc4ed9d770deb252931f3d4890f8f385bd43dcf2a5bfe5b922ec35f4b3144247a7
- TLSH T1EC81533203E429F6C5C90F73254799F3A376CE3417A55A1F4993D71A26486ABEE3D302
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsi59F3.tmp\skin.zip
- Size 1.1MB
- SHA256 35a014ac6690ffa47bd37ce6fa8d6eae11dcdf7d5453610c8a104ffaa890cdc1
- MD5 e93be285d85c590bd22fa4946a4b0cae
- SHA1 25d95d63dfb5a559946752e0845d1b44306b51fb
- SHA512 739c4edcb75c3868bb87d77b650f545a31b99bc9b2a51c6d4783a4a5acf967b9e30fd3a7f189b227788a6d9908a61ee1586a2b54772a4e38fe840e88aa8c243d
- SSDEEP 24576:oxAB8VAsxfpsQRHVAsxfpsQRcVAsxfpsQRFVAsxfpsQRsUBRX:oxdz7z0zVzCUBRX
- TLSH T1AB3523CEDA7263BDCC60E4BF776AC63A8EEF3206D366B2114546A4135205CE427D9393
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-bn.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-mr.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4472_963698753\hyph-nn.hyb
- Size 141KB
- SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
- MD5 f2d8fe158d5361fc1d4b794a7255835a
- SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
- SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
- TLSH T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\PROGRA~2\turbovpn\driver32\DRIVER~1\tap0901.sys
- Size 38KB
- SHA256 a0170cf78105ce757e0549d79e4ae7c412240e8b81d262a24d76a047f181f881
- MD5 059e578d456043a8c3b76ec365b375f3
- SHA1 42189b6a1b8c736397113bfc2283f5e1e1a44e8e
- SHA512 99e6b6af018d0e3509d9dbe00301a7d5d6645a2070a8144acff04842f8bbaccd81e7651578d08f47639cd2b7d00eb64acddfa8725bce9a073580b7fcf7964e6a
- SSDEEP 768:bCxLEO/+ApBG35KBOXZZoZmTD11a+uiExMFYQjdJxh63NOe:tCI46F1a+jExMFFjzv69
- TLSH T1CD039E8167A41897E0AB947483E7DB67FBB9B1431311DBDF0798E6591F23BD0123A328
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\turbovpn\driver32\driver_win10_x64\oemvista.inf
- Size 7KB
- SHA256 817dff7f4944a255a0a33b8d74eb60a755d8d268cc7afd46fce41e102e0a004b
- MD5 50d29ca2e3ddb8a696923420ec2ac4fa
- SHA1 d85f4e65fe10f13ded1780ddbd074edfc75f2d25
- SHA512 03778a9cddd23639c88e24bb5d0446da3a400bb6b3321fb35887cd23d88d0f7ad3fe911642cc7f8d16d29cd9e42106851b0028379e8dbcb3c6721c238fc4a0d3
- SSDEEP 192:wr8tW9yCTi3K4vlQd22bjR+iAUC7bdP+io3DcNSj6jvKFkinuEQTXvzLd4Z:LWlGMdkxzo3DcNSj6jvKFkinuEQTXvzq
- TLSH T15FF14F681C83DE3A31FEE5851B565EC7E25611823A172800345CFC54AB7D99FE73C92A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\turbovpn\driver32\driver_win10_x64\tap0901.cat
- Size 10KB
- SHA256 b0baf5cb84fa4acb34b77a6231052061da6b8676d216833724b7a602622161fb
- MD5 225e7ba0e5e2d46813e5c858a4d0d5b0
- SHA1 5dd49014764f634164520583fd0cec87ab1a1625
- SHA512 9c77adf7e71aca94489dfeb536f796a017b7c05771962274bae2c614e2ae6799cceb36cc58ac470184c37f52deac75988bb14e6a329f432c6d7cedbca18272a8
- SSDEEP 192:PqDhDNF748XJCO39JnxrEwJqKkhYCxXA6qnaj/rHr:OXPJxXxkh3xXhlzX
- TLSH T1232207A2897804C3E9A3AD6053E4F9577D3E37CB181056A925AFF6AA1D933C1F70812D
- MD5 SHA1 SHA512 SSDEEP TLSH