e99d6a42602f47c06e3134d7afbfa4ea1738061c4a164e3d83a19a05eeed2985

Analysis

max time kernel
900s
max time network
707s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/08/2026, 03:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TurboVPN.exe
Size 6.8MB
Sample260809-egqm3agf33
SHA256 e99d6a42602f47c06e3134d7afbfa4ea1738061c4a164e3d83a19a05eeed2985
MD5 f8e1bb2dc2b5de01a8b38e277c07a068
SHA1 aed692f51d2e0ae3e862ee027c63990d80ff7b3e
SHA512 4603dffeeb2ec5800bc198bcec1b8f3284ad472805c1815ec5d0a4b94f8335f4e6ab63df125db7b4457586cd118df71e4ad2d920ef50397f1a67779228dede6b
SSDEEP 98304:zGd+fhXA3MtFHNio3jVxonU1iB+lyXtbuWjB5bBqaRqPfm3EBqdUBEuUEQZZJ5:zGdsAJUhisSjjr0Q6fm3zdUCuUEQ3
TLSH
T10276E062F605C472DA6951B1D4296B35E46CAB3F1B3008CBB2F41F2D9E306D35A36B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion discovery persistence spyware trojan

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
8	ip-api.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	TurboVPN.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4045429996-2364296335-1634900306-1000\Control Panel\International\Geo\Nation	TurboVPN.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Mu\Social	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_2144337681\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1719125007\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Mu\Advertising	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1877996079\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_637535008\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_668406714\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_2144337681\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1722361814\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1106409296\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_244053130\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1722361814\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1722361814\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1360102524\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_668406714\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Sigma\Fingerprinting	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1722361814\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_2144337681\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1360102524\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_2144337681\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1360102524\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Mu\TransparentAdvertisers	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1360102524\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1719125007\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_637535008\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Sigma\Entities	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_244053130\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Mu\Staging	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_1722361814\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-or.hyb	msedgewebview2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TurboVPN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BD64C2D055660BBA0D25407BEB628A1AE8124DFF\Blob = 030000000100000014000000bd64c2d055660bba0d25407beb628a1ae8124dff2000000001000000500500003082054c30820334a00302010202085e821afad743f86d300d06092a864886f70d01010c05003044310b300906035504061302555331133011060355040a130a5374726f6e675377616e3120301e060355040313175468697349735370617274612e77653230323230373036301e170d3232303730363039343234375a170d3235303730353039343234375a3044310b300906035504061302555331133011060355040a130a5374726f6e675377616e3120301e060355040313175468697349735370617274612e7765323032323037303630820222300d06092a864886f70d01010105000382020f003082020a0282020100c2c70bf752bbb7cb04b279494bf348d80b959b68af723e970aaf313b86fb0fdbfe9a7762f6ab1179af90579bb7f5b28e01e14a9d81fe1fd72fa16e9d19b5a5816150685d2536e026dab5ba26b9a6eafc4620a09b6d07fc748a9ec30115e513b6de27f540863350589cbd09f03fb6b0ff5d6dff8e3255a15168b3e43129f754654cdd808a67ef924fd4798e88fabb6dd018200e0fe6b6988a4dbaacf4823f9b81b87ebd76a44e7542ea8fe954f12943655cb31a14c2aca42532702da138762cdfd9a94b0ec94b94cbcc13b699653b2b55dab22b649433e39c0b72c6853cf88ffaf7f8443f3272073cfc13b6ab1f597ed6f5323c66a8ed2f68267fda0fe485cf03921cbeea8111677e5d61d8719099a1611b437207242a7cbf5a099f8b757080b5e5557a08260310917a48732c1dd60ee0b108b93b983156e9461c1aed29bd7b55b4e1bd189fad6b03cda097187860607bbd2d7898e44e3f61aa59ad41d1a475bc7b701cb1a96d4b133d45ed3579dc3b664c08db111c95f6202fa64003fa933468990e5a6a2eafefafed8661b14afdc903643281cb26f40739b0dcb61d511e8cc23703f92eb0f0c655462db3dba7ede7c9a0c5416025a87fc8fd1be654162a4c31e0de6a8cf1a63dd4911692cd9488fae76f87a8c2318f521e6d432710cc44163c8d988081958d2a0b6227a79dd1f70c263e29d9ac6d13fb441c6723756597d7350203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604146a8978ca5ef5c04ba2732e3b517ff3287e94233d300d06092a864886f70d01010c05000382020100762ea81f070c8c10c11ca6996f4fa2cf9983356a1d7d25dcc2f06ec0829db3c8d58e64269db60a6845fee712be84d9a7422caa18660053e546b55958445519d6490b9a9b0f23230e8b9275dc1d9c418cce1b351789128dead8c175b4ec6a12d4b6eef64633fdd2d1d871bf569ee491b15fed5a672ce72179fd293c1c6d29bd171489d4a8814790a81db6f4f72dce970b609ff019c228ee9458d8014af81847967caaace27d58ff20bdacebf2234603610c4d24a54cbbbd68acda3f51f75b71ce42b7382e80cb6baaaa5b5068360aa389adc60e30b562702461d503a1e7cf1dae15cde5f109a3b6bba23634fafb6ae5f01089fccc998f837c5a873a76f60b4ec318d7e05a39a3b38c66e9e300b746f68ba9b9173b04f10c8c0d4bc97c9002cda0f7b9b441abdf48376bf68b246f3ef04b668bd5e20c6c4180b89bc148f881c45afe44f0ec1dd8c9a25b03e3f2632d4bc90b588bfa8bc1d3ca2adc2c873912993bc96fe841e043a8d76e77ace7aae193dd323df4db03df45352eef9da535288de71f798dc25f32af4a02e0f28872acfa5f1cd17497b8460fefd5dbc5ecbdaecad1063589cd714f92550db5626613db6a7508ce3300b58e0584ccb032823f483643d0b856249ba24a06673dede272901d242edaedfc101fec5c5b23b8f2cecd6fbdfc65c24d69395299b97a04fdbf4acb9c523e486455e88c35b3ebd575069dc22c	TurboVPN.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F7368FDF02C8183B8E462BAE2C296B0A9767CCF2\Blob = 030000000100000014000000f7368fdf02c8183b8e462bae2c296b0a9767ccf22000000001000000400500003082053c30820324a00302010202086cbe7f9e3cbde3b2300d06092a864886f70d01010c0500303c310b300906035504061302555331133011060355040a130a5374726f6e675377616e311830160603550403130f5468697349735370617274612e7765301e170d3232303732313037313732305a170d3235303732303037313732305a303c310b300906035504061302555331133011060355040a130a5374726f6e675377616e311830160603550403130f5468697349735370617274612e776530820222300d06092a864886f70d01010105000382020f003082020a0282020100f432a3fbfcb67756ebfbac2ed98c30a298177f22bf595fa11353b5804b5a1fbefcf1fef64c3b5cfd856710cfab5b8dd546a938ef47ca7b0c58d853be8b69b503e996224fdf76dd5f9e9d25d44c05d749d960ad7973468359a6d2a1a6af8bfafe44ce91ec0377a8da59251fc4529b03d58815f447b3692d0a11735dd6b6b597048505106965389b7b0e202e7f69126e3b795e683f7caff80dbebc6cd341e96a9a38e566f8363c670ed1ddf0bf0e1b3d25c8417648ebb65d57b6b9365c48bc7af6c1df2e5873649aaebc9f3588fb4a0bfe2f5d74d80952970abb52278a82797eb73dfa0bc6caf061c813fb9e23f6295492dd0a6ebb5467fc91845deb9da11002a1bf55d36db96ab9fd83ea3368031206a948afdc848c387c1b9a976d899f170c0335669e2ea25dcefb51211ac3dcaf02b0055115536eb314949c92f7ccc4f2cd39dd20f2921b3b8e4bc9dc8e48500b744d4dc6a929b40b2878f7b8560c26a05b6e01877abc2fe2978ad2ca658cd0d1ba6548030535b35651085570fabff5985f53001dd02da8472d425edc9ebb78a1cf7336f7e301279f886ccd5b219e32a9952417fd0fdafc626b97fda41e00d67756bfa8049d3cf81064b5bb438f0f723e7efd6401e1cecf8ed752eb8ba4408b018448fdcba8dc9c9037292dc0379d1607b2680e4cbe9475fb97f99b97313e4818a7d6fdda826034db4f802f4d514ce3e724e70203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414f09a36369b890ed80f99327625cfa09337f48260300d06092a864886f70d01010c05000382020100609dce0b15f2320efd57a2f382e5a8efe641bb5f36f4cb6f4b2d77c9379deb3efc93c5090b445817574c9127118ccba6d0a3c3177c9c5971fe56dbb21aa8ff883f380c35aa42992f3fb763c7958af31177cbd6933b311c3260f474441c5db4e21c436850c777bffc400c1f56759d3df741651664a4edc00248de942aaa7e790c03ee8072baf596bb7aeee73735094e9afc2832a00ebc21bd73093052fc5d6dda4f37320465589805fc5c34090a857045bc7b28358e09ed649ae45de305e44c7611da3710d1352673adbc5e343b93cf04e25e3c4542d03e132a06cf93c5e0585c0f3d417d0249922555a6017f7f4e39ec42e46a0f6e66acd02b015a40798d55f6a24f1d2e5460be4a791bd1703e7cfe6b91fd54c07fcc38e145322eba1980132cf021dfe31274221de91003de34fc7d754dfccc8f40bb1b7600b794a21b77b5b8a054419cccc787964fb3ba1cf19344e70233cea995d542424f00ebbc3f00ca93e4620af291a46b8bebdf87f9920cba8d699125621069f1682ddf51528109b1fc1c88bc88925b6af83290577f54f4f7a5b5af6677ff18a5fe2707a489eed8632fd8951fb53aa18fe9e6b28bfb863fa8641c59e4c92edefb0619c53bc9ac8b4c1413cba900a85799e169a7322c42cee290134d33b5b151626dea93f0f61fe29e9b1badc82b78ade3381000b5d11e3cd40a23225ed66c70fc63299468b69e3fc670	TurboVPN.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TurboVPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	turbo_vpn-service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	turbo_vpn-service.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	TurboVPN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	TurboVPN.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307216642299462"	msedgewebview2.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F7368FDF02C8183B8E462BAE2C296B0A9767CCF2	TurboVPN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	TurboVPN.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c0000000100000004000000000800000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	TurboVPN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BD64C2D055660BBA0D25407BEB628A1AE8124DFF	TurboVPN.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3512	msedgewebview2.exe
3512	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5192	msedgewebview2.exe
5192	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4772	TurboVPN.exe
4772	TurboVPN.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4772	TurboVPN.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5608	turbo_vpn-service.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 5608	4772	TurboVPN.exe	81
PID 4772 wrote to memory of 2488	4772	TurboVPN.exe	93
PID 4772 wrote to memory of 2480	4772	TurboVPN.exe	94
PID 4772 wrote to memory of 5192	4772	TurboVPN.exe	95
PID 5192 wrote to memory of 2340	5192	msedgewebview2.exe	96
PID 5192 wrote to memory of 1156	5192	msedgewebview2.exe	97
PID 5192 wrote to memory of 1156	5192	msedgewebview2.exe	97
PID 5192 wrote to memory of 1156	5192	msedgewebview2.exe	97
PID 5192 wrote to memory of 1176	5192	msedgewebview2.exe	98
PID 5192 wrote to memory of 1328	5192	msedgewebview2.exe	99
PID 5192 wrote to memory of 1328	5192	msedgewebview2.exe	99
PID 5192 wrote to memory of 5944	5192	msedgewebview2.exe	100
PID 5192 wrote to memory of 5944	5192	msedgewebview2.exe	100
PID 5192 wrote to memory of 5944	5192	msedgewebview2.exe	100
PID 5192 wrote to memory of 5272	5192	msedgewebview2.exe	101
PID 5192 wrote to memory of 5272	5192	msedgewebview2.exe	101
PID 5192 wrote to memory of 5272	5192	msedgewebview2.exe	101
PID 5192 wrote to memory of 4764	5192	msedgewebview2.exe	106
PID 5192 wrote to memory of 4764	5192	msedgewebview2.exe	106
PID 5192 wrote to memory of 4152	5192	msedgewebview2.exe	107
PID 5192 wrote to memory of 4152	5192	msedgewebview2.exe	107
PID 5192 wrote to memory of 4512	5192	msedgewebview2.exe	108
PID 5192 wrote to memory of 4512	5192	msedgewebview2.exe	108
PID 5192 wrote to memory of 3512	5192	msedgewebview2.exe	109
PID 5192 wrote to memory of 3332	5192	msedgewebview2.exe	110
PID 5192 wrote to memory of 3332	5192	msedgewebview2.exe	110
PID 5192 wrote to memory of 1136	5192	msedgewebview2.exe	111
PID 5192 wrote to memory of 1136	5192	msedgewebview2.exe	111
PID 5192 wrote to memory of 4284	5192	msedgewebview2.exe	112
PID 5192 wrote to memory of 4284	5192	msedgewebview2.exe	112
PID 5192 wrote to memory of 3856	5192	msedgewebview2.exe	113
PID 5192 wrote to memory of 3856	5192	msedgewebview2.exe	113
PID 5192 wrote to memory of 2432	5192	msedgewebview2.exe	114
PID 5192 wrote to memory of 2432	5192	msedgewebview2.exe	114
PID 5192 wrote to memory of 3900	5192	msedgewebview2.exe	115
PID 5192 wrote to memory of 3900	5192	msedgewebview2.exe	115
PID 5192 wrote to memory of 188	5192	msedgewebview2.exe	116
PID 5192 wrote to memory of 188	5192	msedgewebview2.exe	116
PID 5192 wrote to memory of 2652	5192	msedgewebview2.exe	117
PID 5192 wrote to memory of 2652	5192	msedgewebview2.exe	117

C:\Users\Admin\AppData\Local\Temp\TurboVPN.exe
"C:\Users\Admin\AppData\Local\Temp\TurboVPN.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\turbo_vpn-service.exe
  "C:\Users\Admin\AppData\Local\Temp\turbo_vpn-service.exe" install
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5608
- C:\Users\Admin\AppData\Local\Temp\installtapx64.exe
  "C:\Users\Admin\AppData\Local\Temp\installtapx64.exe" -removeCalloutDriver C:\Users\Admin\AppData\Local\Temp /S
  2⤵
  PID:2488
- C:\Users\Admin\AppData\Local\Temp\installtapx64.exe
  "C:\Users\Admin\AppData\Local\Temp\installtapx64.exe" -removeCalloutDriver C:\Users\Admin\AppData\Local\Temp /S
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4772.2584.7427026816616476008
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\.TurboVPN\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\.TurboVPN\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffbd890b078,0x7ffbd890b084,0x7ffbd890b090
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1824,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=1816 /prefetch:2
    3⤵
    PID:1156
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1932,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=832,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:8
    3⤵
    PID:1328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3272,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
    3⤵
    PID:5944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4160,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
    3⤵
    PID:5272
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3428,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
    3⤵
    PID:4764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2664,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5040,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4436,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4876,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:8
    3⤵
    PID:3332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5056,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4952,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4972,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4476,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1036,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4680,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
    3⤵
    PID:188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\.TurboVPN\EBWebView" --webview-exe-name=TurboVPN.exe --webview-exe-version=3.7.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5004,i,15186128092655043695,1222606709330109805,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
    3⤵
    PID:2652

C:\Users\Admin\AppData\Local\Temp\turbo_vpn-service.exe
"C:\Users\Admin\AppData\Local\Temp\turbo_vpn-service.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\.TurboVPN\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 55fb1e84328bc64f0dd13098c1b6f1c2f09805d243ba623c0b43316e078c3f03
MD5 c8225faf5dc9b4a390ddb0ce00802de2
SHA1 6387d6bc4f543e11a18a0b76048f07d46659ff5b
SHA512 749676ad6d2e4f39755ccabf23bb79a38f2c3f8fb3a138a38861cc52e063c5bf2ab56b70f86567b77be7337982b07561c753f447bfb6a1fc70e6d5e4e5c21f8c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\.TurboVPN\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e967b13f75f00f721d35051795a41a7d6ed38781f3b0469e0602b9e27619c4ec
MD5 0bd2b03cf7dc18da5b02369adbbbedfa
SHA1 50b437bdabef8f53146ac38bf86a1d2cdbfd1582
SHA512 796850afb586e4bb82ba86aa635b556e0e9a7a69e197406309a952753546b7d124e58fffca632196014c2eb434e51532b54326c586af21f2d84aa828636d18b6
TLSH
T1C9D0121672024238C41020330003B5480900C60B41C58004562896EE9E084A01916541
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\.TurboVPN\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Cache\Cache_Data\f_000009
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 d5144e3b2c535b8adf14feffb1b1cc70c1b8b3bb0aed6235fdf62aa289304f50
MD5 bfb207dab51b0206ef23df980614e0a9
SHA1 2d0aeaee6cea5c1dbb29038697470949193f85d7
SHA512 9d04d9ee627a495a12d473d5f87273b389b2ea68670b0868d9322cea686f0abe21e30db4a054049d84ba34716082d7d451c26b4aa4b06bc82c3db08be45a9b3a
TLSH
T118F068ECA0B00E80F3C12BB106ED69003B7C165043573D3F4BC80CB75203301ADC6860
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596b62.TMP

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe596b62.TMP
Size 48B
SHA256 eacb323b6e88f91efa70e0f7f5d86eb806bfb243d5560928da85b92bdd535366
MD5 3622e92828597b065a5132cb17149577
SHA1 64983d715f5d3a1516e0e1ee1a8def3348172e57
SHA512 8d2060e3b74bf30f92915741efa7dd74748b445be7a143b0846689564269b2ddbc0bf9665da0b1ae9fd7aaae55f1d166f5b63e14530e1b123d7aca446be69e0c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\Network Persistent State
Size 6KB
SHA256 c5129c2d4a1934416fa98adb30039c6ce7c895082f35637f3aec01d793173036
MD5 5396371b91da7997f504c28350f285d2
SHA1 3459c6779bfe532756b819cd52b351f6a64565e0
SHA512 3b805da53390b7b1ad86c85a820b0c2f16ffc3e6caa3ccb26436fd5e5d14a4789300b8d61f798e232c0c926a636345ad482b8a33928704fd121d65aa3622a42d
SSDEEP 192:DfIAeueGeTSPHtWqmf5incsnW2fRVuE5TmqUhuDL7g1w:DfIAeueGeePHtWq+5CcsnW2fRVuE5TzD
TLSH
T150D19DE2C7F85A3D8C6122F436256D1BCD5E0D145B283E5ECCE9AB9B57D00A0E74290F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State~RFe59e48a.TMP

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\Network Persistent State~RFe59e48a.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 d58956a2f966a2be75b8bb07b70f49ffc33c98404a03271fcae5ead8eccbc0a2
MD5 8249928ac4c1dd8c14d21a0a0d511326
SHA1 c9c0d3f85746d67a7f7eaad3b1edbf260ad37399
SHA512 6aec3cd978098a42240d9fcff8327183e144c1568af67752654a3bdd36e3d7dd18b5bee6e15d52496edb04374f8e19623c9daca26a6afe81c4180f21946cbce9
TLSH
T1A7F052A382BFF477202C0D760E84BD062C7EB03841816AFCDB9382AD61C05F702074A6
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 bbc5bc32f19b8978de43c6df5758c40f772571528d6e47c47f18a743cd535749
MD5 07d4f9f41af13787b9c95f3da0c8e82b
SHA1 0d33b05cd5820e3c4a1e7db642cfb6f67428ad7f
SHA512 9297192a210bb637c952fa3a2f3219db1be772da9b0e663705702b2f5f52d431eb731a1e4189a806548bb3bf3ba066bc29c481c71a22076d7b4f77efdddd0ad4
TLSH
T137F0596382BFF477202C4D360F84B9061C3FB03945816AFCDBA782AD61C05F7020745A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 9b899ba100f07ea7b612e63365d5fe3ce4ffb1df969e898baaf8530ece09d1b6
MD5 69c6fad91f839d74c9e38f943ddac9dc
SHA1 8028c3ebb23a77bc87c5a6eda5f0bcbd3486dcc9
SHA512 a780656cd697ab00e6fc7ffc2292234ce326c628061bff1357ec4ab8d6463a93ee49e6c2766b2bd0151e71d6ae7810e60e58fdf771a39abc92445f564af15f9c
TLSH
T1EEF0E96381BEF837602C4D760E44B9061D7EB03541C16AFCDF9742AD61805F75607466
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 906f41a7318b393366e67eed6d7705fb0d4bf8e7d0667bab922f975ef3579270
MD5 32cb1f28123d99e01da80683f829fac1
SHA1 d00045019c20ea78b773a12cf96fd784dfe01d2b
SHA512 18689c56c659da12f8f3f824d82c672dfdf4915949199c6d390b1b7d02e79d98008ce0456beaf5e06956dde256a7da6b26a4a528c356a4395a08d75e5706701a
TLSH
T18BF0E963C2BEF437502C0E660E44BD061D7FB03545816AFCDB9791ADA1805F75707457
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 3fb4a276a3d8eda6bb81552a18a2d31ba6bd3552cb239439f35deb1694adb19f
MD5 15f8f2e1cf14898c2b9772fced87f61c
SHA1 1b77bfc7d8cd6c4ca76ff3f47e71348e46bdbcf6
SHA512 9fdf8e71db242c0e016a27a6b040458aa567f926c4bb283cb290d8fc0a6ddf9f735503466762b5cc619d137a4c1acf983d18c5542ba5c1b6959c8fa53f4d26cc
TLSH
T156F0E26382BFF477202C4D760E84B9061D7FB03941816AFCDB9782AD61906F756074A6
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\TransportSecurity
Size 520B
SHA256 064355518a9bfca3354df4e438069b325d0c3069d74ef9f8ff576c363ed9d5d9
MD5 5df4e22b65f386873c048a8e87814c26
SHA1 508cdc98ebb4c27036a32450b42a90126569c2b0
SHA512 8032ba86c312fd7550b2cdd72cc2bebed2072c7c9fa0a0c4119a1fc4709dbdc1bf90de4650ea0a5621b97bcd57386e921dda7975d6f75d27e66f3215db1b5539
TLSH
T138F0E9A382BFF437106C4DA60E48BD061D7EB035418169FCDF9742ADA1815FB5607456
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5930ab.TMP

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Network\TransportSecurity~RFe5930ab.TMP
Size 355B
SHA256 9b329cc5cce0787ff42e1a55d68cd6ae2bff3b165ae701b5624dfcc67547dd7a
MD5 3935eea9f588017a7e811310d3712b74
SHA1 c72080ad6773e7ac3e029e3bc6fde7b021575520
SHA512 74fc72faa64ad9fccf59c0dd980be61b11ea58780d42e58569fbc83adf3fc75729aa8f0577ea3e2e17ce2116ff3f8800686196294f6cee16b6496f077b6874b1
TLSH
T138E0DFB3827EB076A02849364988BD06A97FB03405C27AECDA9781ADA0A05BB1213496
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Preferences
Size 7KB
SHA256 78678517354fa5f6b86c0c7a45a5c222f3335f0b104ab2aef7cdda402fe8b8c6
MD5 d6cf8d133f5a1523b4a857c738aee389
SHA1 9abfae1323d74921cc0657f177b73aecde73eeeb
SHA512 400786afd3afef7193cf080d9f8d8a716905834da3002434d03535d94d7dec69af9fdff61d4419223a635091db87dca57d70a60088752e638d72526e5180baa7
SSDEEP 192:st10fQf1Z8pa0s/S+WiqImwcI5aI5C/BVI9UXWSpHC7+MC:stOfQIU/Vgwc9xVAvC
TLSH
T1C9F1C653A92879B70CC7E629B924FB77E2F6112255D00EA5ABFC851C04DB6DD7207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Preferences
Size 7KB
SHA256 f59f5aacd94b43d58477205f9ac767eb17456363585b3f5d1f6b0ca12ae23bc5
MD5 1c4a29948309b8a773d646e94257ad6c
SHA1 ac74ee10d5e8412c79675ddf0ecf2baf0f7ccd29
SHA512 7f6ff9fa42e37a4e2ba1cdf9f3928af06965cedab341b1233539e000cc2d18a59bedb27fa251da74f63905eb98a83286167a03ec511f0dda8e9e6ec28e67b2a2
SSDEEP 192:st10fyf1Z8pa0s/S+WiqImwcI5aI5C/BVI9UXWSpHpk7+M8:stOfyIU/Vgwc9xVJmv8
TLSH
T1D1F1B453AD2479B70CC7E229B924FB77D2F6112265D44EA5ABFC851C04DB6DC720780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5944a0.TMP

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\Preferences~RFe5944a0.TMP
Size 7KB
SHA256 b0350bde6818a92a41e91b09139e246c744368f4e16ce4cded764a5f625625d6
MD5 f1b62c59665b25a1bc27f627d711f1a0
SHA1 c81897434b78f2ef5fd9249a3abc1e5a0a7479df
SHA512 a880c96cdb17338655b7f23d492f86aeed1cf0b37a1fcb6c41a5827127a3f6ab80d8b65bcf95c92f6b4a80e46e5a3070e93c351d17f5ce90d0cf649490939d6d
SSDEEP 192:st10fyfTZ8pF0s/S+WiqImwcIsI5C/BVI9UXWSpHpk7+M8:stOfyyt/VgwchxVJmv8
TLSH
T117E1A453A92879BB0CC7E22DB825BB77D2F6112295D40EA5EBFC852C04DB5DC610780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\.TurboVPN\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\.TurboVPN\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\.TurboVPN\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\.TurboVPN\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\.TurboVPN\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\.TurboVPN\EBWebView\Local State
Size 4KB
SHA256 02a777dc1ea4cdb46efeb6b6693f4cc93f33bbf5549d5de2bc3b1ef0dd819a8b
MD5 bcaa14e483f171fb9882d86df5052b34
SHA1 d8853784c6b49a3e0d57914a46e89a07eb12ec64
SHA512 83fd1f1bca4740ce1234538d79f5d283422fce6f240b31f07a324a2e5f8bf6e6781d062ee31e8a25814843df06c4ebeb2ffa803facb9dc8aa3d4bf1e13115ec8
SSDEEP 96:zuVbNkCEzkUfy58pZ5U58Frh/cInURoDotoitnvDdBQZP6DaZVSTVlha:zwbNbqkv8L5XooDUDpLDQZZK8
TLSH
T1098193266974AA274DF3D989B9463F53A6A64127D5D13FA8CAEC1F1C02DB39C1302C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\.TurboVPN\EBWebView\Local State
Size 16KB
SHA256 648f6f39e56b0a11c2d17c46d207483e2c804a38b1fcfa748425b347eb6ae10b
MD5 ad9a87dc7cd352dd5126c8af9a7405d8
SHA1 2b45fe99e23418453fc9a03c9767da43a29272ad
SHA512 b184bf308a760292e93391ccdb1c187c92b0299a8edd80dead9cef102503b5d9240d295fd30ecd31bac2b4d2b7339418f82c9888890abb7746e7eca6cb435005
SSDEEP 384:zY+aQikB+z/xvxjg/qhEwNbNkkL5dIL9HH9zq:T/UxvxjgC+UkiIBnFq
TLSH
T1AB729D2B56783E2395F3F5457A18079BDBB5847290C26EB84EED6F0D06DB3D81302D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\.TurboVPN\EBWebView\Local State
Size 1KB
SHA256 7c11c7375dbcde31b2bfc4f20f796dcf778833e9f69f754caaab72f48b962ae9
MD5 7e870efcf8d3d1d6cca2332283281784
SHA1 41c5415869c1b8d54de66725ed646b36721c5c63
SHA512 76ffb4c178c3a13c6e58a61d1be6fc1f0a2bf5858fd8af360ce872fd9193885b43371fbb7c1c6f759a76633f31a2e7b2acbf2d1a2b07e216f82e6d287303c6c9
TLSH
T1BE31A4B2A4A42B335893A5EDB2137ED35D630139C1914F4892ED2B2C02EB2DC562ED33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\.TurboVPN\EBWebView\Local State
Size 2KB
SHA256 1e1ccb946654d81d46e92eacb03409d5ab6a31dae5cfeb55417dd37819044505
MD5 f2182e64a5665849d640f742967d8969
SHA1 cd4b976f41d7361f5579ebdd05b613aedd69dd2b
SHA512 86409cf845bde85747c15740c60aa92b0b3594c6a1a70dd07bdc9c3868808f4aa5d71700a0b6e42a44dcdc4c96944c3e5599f6aea4ed5910c430cd93a4a2b8fe
TLSH
T14551D7336814763749E3999CB9063FA399770165C6922F648AED2B2C01DF29C2302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\.TurboVPN\EBWebView\Local State
Size 3KB
SHA256 0d04b5722aded240c0e1ad67d518f8cb24bf4c24c344ac6e68e8aeb3a399c06e
MD5 8955fdddda4fbf010d4ceed81de0e551
SHA1 5a6239591da6f52b4fdce167d60e088d4b91e35a
SHA512 03ff63eec3614ff884edb587928f41b1eba57c3983e4e33de2518e0a54c67b5328dd76b6515c0bdc6dba3d4bcf074a0908cb737d27ca071ff48537f6c275f2a8
TLSH
T1E07184366964A5374EF39988B9863F53B6A60136D5D13FA8CAEC1F1C02DB39C1302C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58cfed.TMP

Path C:\Users\Admin\.TurboVPN\EBWebView\Local State~RFe58cfed.TMP
Size 1KB
SHA256 0b8c1279e29c6983bcb784899fe250f9d5745d09ec4bdea5e3f6a3a14c99d24f
MD5 e62363efe98f13e4e861efa70ec9e086
SHA1 d5ad6b654d8fbdc001b34d20d72b1ff2e8743fa0
SHA512 3da519b83b7b6e2bbeafade2cce9a9d15d6645f17d59ea05db8042962fd4eb258be33c720848e3f1fb11757bbaf3f1d0b331d33b947ccd1a929d9faad6bfc3bd
TLSH
T11C216276D4982672698798EDF213BEC71DA30139C1914F1C91DD272802EB1DC563AD33
MD5 SHA1 SHA512 TLSH

Submit Download

banner_en.png

Path C:\Users\Admin\AppData\Local\Temp\temp\mainbanner_patch\banner_en.png
Size 37KB
SHA256 8763e18e180133569a7c8c357b5a8277f5507e2515a55a4da78bbe124df5e2ac
MD5 c6fd9534685491d610b23fb2ff0b2686
SHA1 e103fd7a3cb5144cd9ecf40640499210f4468fd2
SHA512 76ba5b4d21e5dd5b8fd29d9135262ca7c720c1c12e47415b529f1cc31696fb380f35453dfcd37855dc4dec0b07f0a9d8b72cf84009b1c8e8a3e081a786af3aee
SSDEEP 768:7JtQW/eqqLzvIHo2/j+TzfggZE+dYFc+1saLrl4z3T9:7Y6eqY8I2L+TzfggZE+dYFcMyd
TLSH
T16303F1F67C56668C9CCF37129C6FD55CDA309A218A74F2AB4BB47019CB691E6112F031
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_351759808\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5192_934530639\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1156-309-0x0000025FDEAA0000-0x0000025FDEACB000-memory.dmp

Download

memory/1156-65-0x00007FFBF5210000-0x00007FFBF5211000-memory.dmp

Download

memory/1328-108-0x00007FFBF5240000-0x00007FFBF5241000-memory.dmp

Download

memory/1328-107-0x00007FFBF5010000-0x00007FFBF5011000-memory.dmp

Download

memory/3512-561-0x000001D80E2A0000-0x000001D80E2A1000-memory.dmp

Download

memory/3512-568-0x000001D80E2A0000-0x000001D80E2A1000-memory.dmp

Download

memory/3512-566-0x000001D80E2A0000-0x000001D80E2A1000-memory.dmp

Download

memory/3512-567-0x000001D80E2A0000-0x000001D80E2A1000-memory.dmp

Download

memory/3512-569-0x000001D80E2A0000-0x000001D80E2A1000-memory.dmp

Download

memory/3512-570-0x000001D80E2A0000-0x000001D80E2A1000-memory.dmp

Download

memory/3512-571-0x000001D80E2A0000-0x000001D80E2A1000-memory.dmp

Download

memory/3512-565-0x000001D80E2A0000-0x000001D80E2A1000-memory.dmp

Download

memory/3512-559-0x000001D80E2A0000-0x000001D80E2A1000-memory.dmp

Download

memory/3512-560-0x000001D80E2A0000-0x000001D80E2A1000-memory.dmp

Download

memory/5192-294-0x000001EDD6FB0000-0x000001EDD7FB0000-memory.dmp

Download

memory/5944-110-0x00007FFBF5210000-0x00007FFBF5211000-memory.dmp

Download