34eb83f3f4b7436da13f9ffbc241658c03887c74e574764e40dc8ab93c05bcad

Analysis

user interaction
yes
max time kernel
61s
max time network
95s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UrbanVPN.exe
Size 70.5MB
Sample260908-a64trsxtb1
SHA256 34eb83f3f4b7436da13f9ffbc241658c03887c74e574764e40dc8ab93c05bcad
MD5 516e7bfbc62b214e990a7a56ec157266
SHA1 9bb5da1c3fc6396b17abeaff5df633b5bf1ac7d0
SHA512 57032824f15f2717917869962e4c710c95a5ce1bc74a22a7f5c083bdf60fbed4ba3ac22487ef65502d6c97ac6cd5af3c37f2c6fda4fca60f2d6904542cce0ba7
SSDEEP 1572864:PFxb8yuOga7/5RCgiqnyuP0y0fqzYOr2gPAvfxzhpx56Bu61FZPZdxQcUze:jziqnFsyuqzp4xb6I61vhdicMe
TLSH
T13BF73321B58AC42BD66215B05B2D9AAE562CBE350B7148C7B3DCBD1F27B45C30233E67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{77169412-f642-45e7-b533-0c6f48de12f9} = "\"C:\\ProgramData\\Package Cache\\{77169412-f642-45e7-b533-0c6f48de12f9}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{77169412-f642-45e7-b533-0c6f48de12f9} = "\"C:\\ProgramData\\Package Cache\\{77169412-f642-45e7-b533-0c6f48de12f9}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UrbanVPN = "\"C:\\Program Files\\UrbanVPN\\Urban Vpn Updater.exe\" /checknow -minuseractions -restartapp \"C:\\Program Files\\UrbanVPN\\bin\\urban-vpn-app.exe\" -restartappcmd \"--tray-minimized\""	msiexec.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
16	6112	MsiExec.exe
17	6112	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	UrbanVPN.exe
File opened (read-only)	\??\I:	UrbanVPN.exe
File opened (read-only)	\??\W:	UrbanVPN.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	UrbanVPN.exe
File opened (read-only)	\??\S:	UrbanVPN.exe
File opened (read-only)	\??\B:	UrbanVPN.exe
File opened (read-only)	\??\N:	UrbanVPN.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	UrbanVPN.exe
File opened (read-only)	\??\Q:	UrbanVPN.exe
File opened (read-only)	\??\J:	UrbanVPN.exe
File opened (read-only)	\??\P:	UrbanVPN.exe
File opened (read-only)	\??\U:	UrbanVPN.exe
File opened (read-only)	\??\Q:	UrbanVPN.exe
File opened (read-only)	\??\R:	UrbanVPN.exe
File opened (read-only)	\??\X:	UrbanVPN.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	UrbanVPN.exe
File opened (read-only)	\??\K:	UrbanVPN.exe
File opened (read-only)	\??\M:	UrbanVPN.exe
File opened (read-only)	\??\Z:	UrbanVPN.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	UrbanVPN.exe
File opened (read-only)	\??\R:	UrbanVPN.exe
File opened (read-only)	\??\T:	UrbanVPN.exe
File opened (read-only)	\??\W:	UrbanVPN.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	UrbanVPN.exe
File opened (read-only)	\??\H:	UrbanVPN.exe
File opened (read-only)	\??\L:	UrbanVPN.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	UrbanVPN.exe
File opened (read-only)	\??\J:	UrbanVPN.exe
File opened (read-only)	\??\M:	UrbanVPN.exe
File opened (read-only)	\??\S:	UrbanVPN.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	UrbanVPN.exe
File opened (read-only)	\??\I:	UrbanVPN.exe
File opened (read-only)	\??\P:	UrbanVPN.exe
File opened (read-only)	\??\Y:	UrbanVPN.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	UrbanVPN.exe
File opened (read-only)	\??\K:	UrbanVPN.exe
File opened (read-only)	\??\A:	UrbanVPN.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	UrbanVPN.exe
File opened (read-only)	\??\V:	UrbanVPN.exe
File opened (read-only)	\??\D:	UrbanVPN.exe
File opened (read-only)	\??\V:	UrbanVPN.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	UrbanVPN.exe
File opened (read-only)	\??\O:	UrbanVPN.exe
File opened (read-only)	\??\T:	UrbanVPN.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in System32 directory 53 IoCs

description	ioc	Process
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\064D75DF60A1456F63CEF9F347BAA00B_E54FB72B2D8B865F329FB65A1441F61C	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\064D75DF60A1456F63CEF9F347BAA00B_E54FB72B2D8B865F329FB65A1441F61C	urban-vpn-service.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	MsiExec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\UrbanVPN\bin\Qt6Quick3DUtils.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6QuickControls2MaterialStyleImpl.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\win11\ovpn-dco.cat	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\source.md	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\win10\ovpn-dco.cat	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6Quick.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQml\Models\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Material\impl\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\UrbanVpn_UiControlsEarly.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Basic\impl\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\FluentWinUI3\impl\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Fusion\qtquickcontrols2fusionstyleplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\UrbanVpn\UiControls\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_lg.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6LabsPlatform.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6Qml.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6QmlCore.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Fusion\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_cs.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_hr.qm	msiexec.exe
File opened for modification	C:\Program Files\UrbanVPN\Urban Vpn Updater.ini	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\d3dcompiler_47.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\iconengines\qsvgicon.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\imageformats\qjpeg.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Imagine\impl\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Universal\impl\qtquickcontrols2universalstyleimplplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_fi.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_ka.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_nn.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6QuickTemplates2.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\UrbanVpn_UiControls.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\qmltooling\qmldbg_tcp.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtCore\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Templates\qtquicktemplates2plugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_fr.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_nl.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6QmlModels.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6QuickEffects.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\imageformats\qgif.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Fusion\impl\qtquickcontrols2fusionstyleimplplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_en.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_lv.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_pl.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\Qt6QmlWorkerScript.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\UrbanVpn\UiGlobal\UrbanVpn_UiGlobalplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_zh_CN.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\win11\ovpn-dco.inf	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\qmltooling\qmldbg_local.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\qmltooling\qmldbg_messages.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_it.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_zh_TW.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\msvcr100.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\ovpn-dco-win-2.8.2-amd64\win10\ovpn-dco.inf	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\qmltooling\qmldbg_debugger.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Imagine\impl\qtquickcontrols2imaginestyleimplplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\UrbanVpn\UiControlsEarly\qmldir	msiexec.exe
File created	C:\Program Files\UrbanVPN\translations\qt_he.qm	msiexec.exe
File created	C:\Program Files\UrbanVPN\bin\libssl-1_1-x64.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\platforminputcontexts\qtvirtualkeyboardplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\FluentWinUI3\impl\qtquickcontrols2fluentwinui3styleimplplugin.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\qmltooling\qmldbg_quick3dprofiler.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\plugins\tls\qschannelbackend.dll	msiexec.exe
File created	C:\Program Files\UrbanVPN\qml\QtQuick\Controls\Basic\qmldir	msiexec.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI50DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B4B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E4E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{7998CAE9-FE17-41C2-97D8-294C383653A3}\urbanvpnapp.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF37B73291D8AAF208.TMP	msiexec.exe
File created	C:\Windows\Installer\e59f508.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F64.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2227.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI27BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI57E6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f4f5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFDA1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21B7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2314.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFE09DD3F6AD3D641.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B7B.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6F04608514C83835.TMP	msiexec.exe
File created	C:\Windows\Installer\e59f51e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI381E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3C67.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F2A.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f520.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE2A335F040C67444.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF97AE6F5B639E31A5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f508.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2256.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22D4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7998CAE9-FE17-41C2-97D8-294C383653A3}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0CA93EAD610C48BE.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2587.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI277F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI570A.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f51d.msi	msiexec.exe
File created	C:\Windows\Installer\e59f507.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA44.tmp	msiexec.exe
File created	C:\Windows\Installer\e59f4f5.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF88E59413B2913703.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9A778B0451A677C5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2645.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59f51e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34E0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D91.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFAC1.tmp	msiexec.exe
File created	C:\Windows\Installer\{7998CAE9-FE17-41C2-97D8-294C383653A3}\urbanvpnapp.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3510.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{7998CAE9-FE17-41C2-97D8-294C383653A3}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{560D2DA4-096E-4868-B22A-DA6418FDE6FB}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5116FE85CCEFA0E5.TMP	msiexec.exe
File created	C:\Windows\Installer\{7998CAE9-FE17-41C2-97D8-294C383653A3}\SystemFoldermsiexec.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5904914B-9FC8-44C2-AE48-5C7F30A603EC}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI25C6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DB1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF46FC5FD87EC0A229.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2373.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI279F.tmp	msiexec.exe

Executes dropped EXE 12 IoCs

pid	Process
948	VC_redist.x64.exe
5216	VC_redist.x64.exe
796	VC_redist.x64.exe
4444	VC_redist.x64.exe
1728	VC_redist.x64.exe
1304	VC_redist.x64.exe
3220	VC_redist.x64.exe
5712	MSI3F2A.tmp
4428	Urban Vpn Updater.exe
2420	urban-vpn-service.exe
5724	Urban Vpn Updater.exe
4992	Urban Vpn Updater.exe

Loads dropped DLL 64 IoCs

pid	Process
5988	UrbanVPN.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
5988	UrbanVPN.exe
5216	VC_redist.x64.exe
1304	VC_redist.x64.exe
1152	VC_redist.x64.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
6112	MsiExec.exe
6112	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
6112	MsiExec.exe
6112	MsiExec.exe
6112	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
5600	MsiExec.exe
6112	MsiExec.exe
6112	MsiExec.exe
4776	MsiExec.exe
4776	MsiExec.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe
2420	urban-vpn-service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Urban Vpn Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Urban Vpn Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Urban Vpn Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UrbanVPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI3F2A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UrbanVPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UrbanVPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VC_redist.x64.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1732	msedge.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000002fab76c52da068360000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838012fab76c50000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841012fab76c5000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e32fab76c500000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e62fab76c500000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\29\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	urban-vpn-service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\4AD2D065E69086842BA2AD4681DF6EBF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B41940958CF92C44EA84C5F7036A30CE	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{77169412-f642-45e7-b533-0c6f48de12f9}	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EAC899771EF2C14798D92C48363353A\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\Dependents\{77169412-f642-45e7-b533-0c6f48de12f9}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\ = "{560D2DA4-096E-4868-B22A-DA6418FDE6FB}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B41940958CF92C44EA84C5F7036A30CE\VC_Runtime_Additional	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\urban\DefaultIcon\ = "C:\\Program Files\\UrbanVPN\\bin\\urban-vpn-app.exe,1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EAC899771EF2C14798D92C48363353A\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\urban	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\urban\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\PackageCode = "5E78E5602FA7A974088E3902313D8AF2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\urban\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33816"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EAC899771EF2C14798D92C48363353A\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\ProductName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33816"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\urban	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\9EAC899771EF2C14798D92C48363353A	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{560D2DA4-096E-4868-B22A-DA6418FDE6FB}v14.40.33816\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\urban\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\urban\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\ = "{77169412-f642-45e7-b533-0c6f48de12f9}"	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\urban\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\urban\shell\open\command\ = "\"C:\\Program Files\\UrbanVPN\\bin\\urban-vpn-app.exe\" \"%1\""	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\Version = "237536280"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{560D2DA4-096E-4868-B22A-DA6418FDE6FB}v14.40.33816\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Media	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{5904914B-9FC8-44C2-AE48-5C7F30A603EC}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B41940958CF92C44EA84C5F7036A30CE\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33816"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33816"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\ = "{77169412-f642-45e7-b533-0c6f48de12f9}"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33816"	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.40,bundle\DisplayName = "Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.40.33816"	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B41940958CF92C44EA84C5F7036A30CE\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{5904914B-9FC8-44C2-AE48-5C7F30A603EC}v14.40.33816\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9EAC899771EF2C14798D92C48363353A\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\4AD2D065E69086842BA2AD4681DF6EBF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4AD2D065E69086842BA2AD4681DF6EBF\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{77169412-f642-45e7-b533-0c6f48de12f9}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle\Dependents	VC_redist.x64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
2840	MsiExec.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3812	msiexec.exe
Token: SeCreateTokenPrivilege	5988	UrbanVPN.exe
Token: SeAssignPrimaryTokenPrivilege	5988	UrbanVPN.exe
Token: SeLockMemoryPrivilege	5988	UrbanVPN.exe
Token: SeIncreaseQuotaPrivilege	5988	UrbanVPN.exe
Token: SeMachineAccountPrivilege	5988	UrbanVPN.exe
Token: SeTcbPrivilege	5988	UrbanVPN.exe
Token: SeSecurityPrivilege	5988	UrbanVPN.exe
Token: SeTakeOwnershipPrivilege	5988	UrbanVPN.exe
Token: SeLoadDriverPrivilege	5988	UrbanVPN.exe
Token: SeSystemProfilePrivilege	5988	UrbanVPN.exe
Token: SeSystemtimePrivilege	5988	UrbanVPN.exe
Token: SeProfSingleProcessPrivilege	5988	UrbanVPN.exe
Token: SeIncBasePriorityPrivilege	5988	UrbanVPN.exe
Token: SeCreatePagefilePrivilege	5988	UrbanVPN.exe
Token: SeCreatePermanentPrivilege	5988	UrbanVPN.exe
Token: SeBackupPrivilege	5988	UrbanVPN.exe
Token: SeRestorePrivilege	5988	UrbanVPN.exe
Token: SeShutdownPrivilege	5988	UrbanVPN.exe
Token: SeDebugPrivilege	5988	UrbanVPN.exe
Token: SeAuditPrivilege	5988	UrbanVPN.exe
Token: SeSystemEnvironmentPrivilege	5988	UrbanVPN.exe
Token: SeChangeNotifyPrivilege	5988	UrbanVPN.exe
Token: SeRemoteShutdownPrivilege	5988	UrbanVPN.exe
Token: SeUndockPrivilege	5988	UrbanVPN.exe
Token: SeSyncAgentPrivilege	5988	UrbanVPN.exe
Token: SeEnableDelegationPrivilege	5988	UrbanVPN.exe
Token: SeManageVolumePrivilege	5988	UrbanVPN.exe
Token: SeImpersonatePrivilege	5988	UrbanVPN.exe
Token: SeCreateGlobalPrivilege	5988	UrbanVPN.exe
Token: SeCreateTokenPrivilege	5988	UrbanVPN.exe
Token: SeAssignPrimaryTokenPrivilege	5988	UrbanVPN.exe
Token: SeLockMemoryPrivilege	5988	UrbanVPN.exe
Token: SeIncreaseQuotaPrivilege	5988	UrbanVPN.exe
Token: SeMachineAccountPrivilege	5988	UrbanVPN.exe
Token: SeTcbPrivilege	5988	UrbanVPN.exe
Token: SeSecurityPrivilege	5988	UrbanVPN.exe
Token: SeTakeOwnershipPrivilege	5988	UrbanVPN.exe
Token: SeLoadDriverPrivilege	5988	UrbanVPN.exe
Token: SeSystemProfilePrivilege	5988	UrbanVPN.exe
Token: SeSystemtimePrivilege	5988	UrbanVPN.exe
Token: SeProfSingleProcessPrivilege	5988	UrbanVPN.exe
Token: SeIncBasePriorityPrivilege	5988	UrbanVPN.exe
Token: SeCreatePagefilePrivilege	5988	UrbanVPN.exe
Token: SeCreatePermanentPrivilege	5988	UrbanVPN.exe
Token: SeBackupPrivilege	5988	UrbanVPN.exe
Token: SeRestorePrivilege	5988	UrbanVPN.exe
Token: SeShutdownPrivilege	5988	UrbanVPN.exe
Token: SeDebugPrivilege	5988	UrbanVPN.exe
Token: SeAuditPrivilege	5988	UrbanVPN.exe
Token: SeSystemEnvironmentPrivilege	5988	UrbanVPN.exe
Token: SeChangeNotifyPrivilege	5988	UrbanVPN.exe
Token: SeRemoteShutdownPrivilege	5988	UrbanVPN.exe
Token: SeUndockPrivilege	5988	UrbanVPN.exe
Token: SeSyncAgentPrivilege	5988	UrbanVPN.exe
Token: SeEnableDelegationPrivilege	5988	UrbanVPN.exe
Token: SeManageVolumePrivilege	5988	UrbanVPN.exe
Token: SeImpersonatePrivilege	5988	UrbanVPN.exe
Token: SeCreateGlobalPrivilege	5988	UrbanVPN.exe
Token: SeCreateTokenPrivilege	5988	UrbanVPN.exe
Token: SeAssignPrimaryTokenPrivilege	5988	UrbanVPN.exe
Token: SeLockMemoryPrivilege	5988	UrbanVPN.exe
Token: SeIncreaseQuotaPrivilege	5988	UrbanVPN.exe
Token: SeMachineAccountPrivilege	5988	UrbanVPN.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5988	UrbanVPN.exe
4552	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3812	msiexec.exe
2840	MsiExec.exe
5988	UrbanVPN.exe
5988	UrbanVPN.exe
5600	MsiExec.exe
6112	MsiExec.exe
4776	MsiExec.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 2840	3812	msiexec.exe	90
PID 2840 wrote to memory of 4724	2840	MsiExec.exe	92
PID 5988 wrote to memory of 948	5988	UrbanVPN.exe	93
PID 948 wrote to memory of 5216	948	VC_redist.x64.exe	94
PID 5216 wrote to memory of 796	5216	VC_redist.x64.exe	95
PID 4444 wrote to memory of 1728	4444	VC_redist.x64.exe	106
PID 1728 wrote to memory of 1304	1728	VC_redist.x64.exe	107
PID 1304 wrote to memory of 3220	1304	VC_redist.x64.exe	108
PID 3220 wrote to memory of 1612	3220	VC_redist.x64.exe	110
PID 1612 wrote to memory of 1152	1612	VC_redist.x64.exe	111
PID 1152 wrote to memory of 2844	1152	VC_redist.x64.exe	112
PID 5988 wrote to memory of 1868	5988	UrbanVPN.exe	113
PID 3812 wrote to memory of 5600	3812	msiexec.exe	114
PID 3812 wrote to memory of 6112	3812	msiexec.exe	115
PID 3812 wrote to memory of 5712	3812	msiexec.exe	116
PID 5712 wrote to memory of 4552	5712	MSI3F2A.tmp	117
PID 4552 wrote to memory of 704	4552	msedge.exe	118
PID 4552 wrote to memory of 5472	4552	msedge.exe	119
PID 4552 wrote to memory of 1732	4552	msedge.exe	120
PID 4552 wrote to memory of 5472	4552	msedge.exe	119
PID 4552 wrote to memory of 5472	4552	msedge.exe	119
PID 4552 wrote to memory of 2448	4552	msedge.exe	121
PID 4552 wrote to memory of 2448	4552	msedge.exe	121
PID 4552 wrote to memory of 1388	4552	msedge.exe	123
PID 4552 wrote to memory of 1388	4552	msedge.exe	123
PID 4552 wrote to memory of 1388	4552	msedge.exe	123
PID 4552 wrote to memory of 3168	4552	msedge.exe	124
PID 4552 wrote to memory of 3168	4552	msedge.exe	124
PID 4552 wrote to memory of 3168	4552	msedge.exe	124
PID 4552 wrote to memory of 5780	4552	msedge.exe	125
PID 4552 wrote to memory of 5780	4552	msedge.exe	125
PID 4552 wrote to memory of 5780	4552	msedge.exe	125
PID 4552 wrote to memory of 4812	4552	msedge.exe	126
PID 4552 wrote to memory of 4812	4552	msedge.exe	126
PID 4552 wrote to memory of 4812	4552	msedge.exe	126
PID 4552 wrote to memory of 2828	4552	msedge.exe	128
PID 4552 wrote to memory of 2828	4552	msedge.exe	128
PID 3812 wrote to memory of 4776	3812	msiexec.exe	129
PID 3812 wrote to memory of 4428	3812	msiexec.exe	130
PID 4552 wrote to memory of 5932	4552	msedge.exe	134
PID 4552 wrote to memory of 4408	4552	msedge.exe	135
PID 4552 wrote to memory of 5932	4552	msedge.exe	134
PID 4552 wrote to memory of 4408	4552	msedge.exe	135
PID 4552 wrote to memory of 5580	4552	msedge.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\UrbanVPN.exe
"C:\Users\Admin\AppData\Local\Temp\UrbanVPN.exe"
1⤵
- Enumerates connected drives
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe
  "C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe" /q /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\Temp\{8C606ADC-23E8-48B1-BE25-6EA3201D7F10}\.cr\VC_redist.x64.exe
    "C:\Windows\Temp\{8C606ADC-23E8-48B1-BE25-6EA3201D7F10}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /q /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5216
  - - C:\Windows\Temp\{5AB5BC3C-16B9-46AB-BD2E-DBDC4FD929E1}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{5AB5BC3C-16B9-46AB-BD2E-DBDC4FD929E1}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{D070D264-CE16-44B9-9F45-28F2F395EAEA} {FE6BDFB0-B304-4100-88B1-C298B2D7C236} 5216
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:796
- C:\Users\Admin\AppData\Local\Temp\UrbanVPN.exe
  "C:\Users\Admin\AppData\Local\Temp\UrbanVPN.exe" /i "C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN 5.2.2.8569\install\83653A3\UrbanVPN.msi" AI_EUIMSI=1 APPDIR="C:\Program Files\UrbanVPN" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UrbanVPN" SECONDSEQUENCE="1" CLIENTPROCESSID="5988" AI_MORE_CMD_LINE=1
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:1868

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C27B7B865CA432D7ABDFC78F0415BC60 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\AppData\Local\Temp\UrbanVPN.exe
    "C:\Users\Admin\AppData\Local\Temp\UrbanVPN.exe" /groupsextract:100; /out:"C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites" /callbackid:2840
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4724
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6DE8C5193CAACF388F3071473B75E12D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5600
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1D5C13072F2FC73743482FAEE0E8B067
  2⤵
  - Badlisted process makes network request
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:6112
- C:\Windows\Installer\MSI3F2A.tmp
  "C:\Windows\Installer\MSI3F2A.tmp" https://www.urban-vpn.com/install-desk/
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.urban-vpn.com/install-desk/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x360,0x7ffeec3ec188,0x7ffeec3ec194,0x7ffeec3ec1a0
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,15155105070004716489,15686225105429226990,262144 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,14040156380808445193,15050584730964776227,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,12428539076083660930,8771869318600327606,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,12222171312630157817,5252274239773267799,2097152 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,2028763237349599149,16951688894611953510,2097152 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,12301924203681527531,7140461839388405008,2097152 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,6629154870466588234,7167563953102731035,2097152 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,4745350933521100794,5151622174871385850,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,16366440840507824187,2366667159909340124,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,14730509055476916882,11637782627460008312,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16162303880707258196,3460965331714382869,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16162303880707258196,3460965331714382869,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,5940013870189072285,10705277067833822146,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:7104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,15866650643804225298,11138676988491049114,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,16419542854488485468,13261678556253976040,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:7100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,13208279439431766376,17332583085559321141,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:7144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,2752765104059697754,13448911921353967948,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
      4⤵
      PID:7048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,766448921477197306,9799645182524256431,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:7064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,913846286373910212,13624286973799462106,524288 --field-trial-handle=2108,i,15365483456411191997,9776535078524398397,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:6880
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8912E5ADCE0780092053BB530C574802 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4776
- C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
  "C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /configservice -name "UrbanVPN-Updater"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4428

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4584

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:4784

C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
"C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444
- C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
  "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908015110.log"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
    "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /norestart /burn.log.append "C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908015110.log"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe
      "C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{803FBF83-C9B2-42DB-BD9F-B69FDF74032B} {F108584E-066A-40A6-B02B-A7B27E607F53} 1304
      4⤵
      Adds Run key to start application
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3220
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{4B37FEE0-0800-41E6-A879-5EBF9E5E005C} {D0FE4414-BF9F-4F08-A0B8-765E465B1510} 3220
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1612
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=556 -burn.filehandle.self=576 -uninstall -quiet -burn.related.upgrade -burn.ancestors={77169412-f642-45e7-b533-0c6f48de12f9} -burn.filehandle.self=1016 -burn.embedded BurnPipe.{4B37FEE0-0800-41E6-A879-5EBF9E5E005C} {D0FE4414-BF9F-4F08-A0B8-765E465B1510} 3220
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{031AA7B0-48C2-441F-97F3-E662FFF8DAF0} {66F397AC-1D82-4AF9-A254-4A457C45EA96} 1152
        7⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2336

C:\Program Files\UrbanVPN\bin\urban-vpn-service.exe
"C:\Program Files\UrbanVPN\bin\urban-vpn-service.exe"
1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:2420

C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
"C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /checknow -minuseractions -restartapp "C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe" -restartappcmd "--tray-minimized"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5724
- C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe
  "C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe" --tray-minimized
  2⤵
  PID:6576

C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
"C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /runservice
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1804

C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
"C:\Program Files\UrbanVPN\Urban Vpn Updater.exe" /checknow -minuseractions -restartapp "C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe"
1⤵
PID:6640
- C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe
  "C:\Program Files\UrbanVPN\bin\urban-vpn-app.exe"
  2⤵
  PID:6916

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "9" "C:\Windows\Temp\6906ce50a20e297c57bf85d0531e6f1953640cdbe8a986ed490b2a9cc3d779bf\wireguard.inf" "9" "47d19a6b7" "000000000000016C" "Service-0x0-3e7$\Default" "000000000000018C" "208" "C:\Windows\Temp\6906ce50a20e297c57bf85d0531e6f1953640cdbe8a986ed490b2a9cc3d779bf"
1⤵
PID:6440

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "0" "SWD\WireGuard\{7A1B3C4D-5E6F-4A8B-9C0D-1E2F3A4B5C6D}" "" "" "4c18945bf" "0000000000000000" "70b1"
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59f4fa.rbs

Path C:\Config.Msi\e59f4fa.rbs
Size 19KB
SHA256 55833dcc797464b8275b37b99495e229dafdd62009a55e95cfdc336024f867cb
MD5 ccc1f14fafeefe36089f3d7b20ac640d
SHA1 a04f4b39bb42d42b0b9ee1d245e7fb36c8b00a08
SHA512 d5f458454c31fc0229ebe944535f4a2e933668d875ed2964e04741ed142c78b20b172218129dbb16e768048cf9267cc9d457dee72d68bfae2946ac380a7796af
SSDEEP 192:4dRN1kRx15dXcFUADIc1f+W+y4+ogPzH7:4dRN6RxTeC81f/cYH7
TLSH
T1DA92EB426680C9D2D8766B30CD675F653B76DBD5A350438B50DC90308FA3BCA2F9D68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f506.rbs

Path C:\Config.Msi\e59f506.rbs
Size 19KB
SHA256 e4df28a040ab8bafc0e59e5075ecec55691f4e0c3a749aed97e26d1ac23e6778
MD5 1e04f20c6f54aedbc51ba05ad6222022
SHA1 2619a59a20ae9e3dd1d2048d8df0fc60f67e6d97
SHA512 c80df2ff9d14ed55943d3c5c0da5457017884ca82311c01582be39f202c1f4bb569e956ee71e5986a5c550586e803f58251696ce2bdccc0f93f098171a2aca47
SSDEEP 192:7cXsiX1XMcXMEXMdXMHXMNXM6XM+YXMXXMJXMyXMnXMMXMPXM7XMhXcXlX2YXV6Y:77Xv28mpaMSxcHUQp2BRBjL
TLSH
T13692FC02AA40C6D3D8A62F30DD571F2A3775D3EA9750935B01DDD1308F937C66E8D68A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f50d.rbs

Path C:\Config.Msi\e59f50d.rbs
Size 21KB
SHA256 afce94185d740b9ef26c67c83cb6812aa37a167c69c09932e2eae1f98af21503
MD5 493f922e2fbb01b1eb05e7c99d86b00e
SHA1 db6fc7cdcf21634831ea9c1dd73f6492ce34d0fe
SHA512 cb0d4b4d2e5b676c79e30b23f61a82c9327e01c8d8c7ada598dfad859b3019640301638173610086654413b099664bf744573a119dd8bd00eebd1c1586d8c79a
SSDEEP 384:23RsGRAnAKxNAUhUC7xJjrMNYPzIbSf404TiiZyXMfJkP:2h9wAKhkmx
TLSH
T1BFA21F43768089E3C8A627B1DD671BA93B73D7D99350434710ACD1348F633CB2F5AA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f51c.rbs

Path C:\Config.Msi\e59f51c.rbs
Size 21KB
SHA256 e415695638349fa43f8891fbf52359a6ec666d8087ff4b3a438079c796383b05
MD5 ad15b46398f4c4e541fdedf238e0206f
SHA1 3713e357ea3b86f169c79b1739e1e4eb0769a92d
SHA512 6203dd0bc868171b5f96f494795ab2d3418d3ade56f6f4a851a9a25dfd9c5d5c216eb250085665f190922d3163fb2bfb425011a1f0a1ddff0a2cda574bdb496f
SSDEEP 384:pUrQoNFcB1np12gju4aD92salckU72eC6Ab/eYqYJoV4Nn5:pUrQoNFcB1np12gSLD9AbmjuoVUn5
TLSH
T127A20F01AA44D593D8A62B70CD9747A537B6D3D9D7A1838B12CDC2304F933C71FAEA4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59f51f.rbs

Path C:\Config.Msi\e59f51f.rbs
Size 383KB
SHA256 b9c336ffe7a18f32b384e040d616f0209b6073812ca2a24fd5d769316db8ec54
MD5 bd60900a1e2aa90bd82e7dc2b67344ef
SHA1 63b974bba535b8bd6fdd126357ac78ed0b3c78c6
SHA512 9d6e86c1fb07d339d1d98f47d7a92bbac7440c52b31fafd7138ea2fe7c4af8f068dceb77eca0260a9504dd8bf3c5416319f6a4e5264266ba73e418f62db15d3d
SSDEEP 6144:xsbvBbhOr4+T1lqK0rklph0lhSMXlBXBW/+BO8xCuX:xsbhwtl6klph0lhSMXle+EWCuX
TLSH
T1AB84BF60F902C1B7E71E19B02B59EFC95B2E89A94F5104DF23DC5A7BCD306C14B386A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Urban Vpn Updater.exe

Path C:\Program Files\UrbanVPN\Urban Vpn Updater.exe
Size 1.8MB
SHA256 a038315150b99295efde8cead68182b06aec882f6df004229e083748ac41bedf
MD5 0cf39fa54c5f3cd7bc84155cdb9bbd18
SHA1 e3c223ee4198047e222aa374cace75d4f8cfa774
SHA512 66ba60f62860ab8269d8c5e85c4d7cbacd4a86a8d3b2c70e37aac61596eb6bf392f3310429a7662644dd1eeaa2580308f9adbe8b6390957ac790e7e03806f260
SSDEEP 49152:QJ1O7EpfelenkVglN5suzIEUP7ZmQNRB6XG+ChS9GBaaaa8arab7aa7azcPcvGqx:QSVqkVglN5yh+mpaaaa8arab7aa7azc8
TLSH
T1DC857E71369BC43BC47E40B06539F9AF953E6D269F5898C3A3C87D2D1A744C21632F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Urban Vpn Updater.ini

Path C:\Program Files\UrbanVPN\Urban Vpn Updater.ini
Size 106B
SHA256 d987a5c91d681397f696060973228c37c78c04addb27f75c844f2dbffb2255e7
MD5 ecd91edd75734f035b80ee49bdf945f1
SHA1 7aaaeb11871fa92810b0e2f1867986af331eb130
SHA512 ed2bd08e0f9d71e7f4b22cd10caf0c216cc149cd1ae5c0846f6f059d071c92b2342c4eac3b9d560b3efa0d793b41faf1f520f13c9aa100d9a7ed1c0129ea7021
TLSH
T151B01286CE6D84AD114331D01319A0F00753012C5B2500644245F22FF011F6946CE2B8
MD5 SHA1 SHA512 TLSH

Submit Download

Urban Vpn Updater.ini

Path C:\Program Files\UrbanVPN\Urban Vpn Updater.ini
Size 389B
SHA256 49a7bac06719deba6a7548bfa816075812172df9e8aff766c9dd8822b1ae98dd
MD5 4b4ac506684219669e1137e87f8a4dcc
SHA1 950a84b4a4fa68ade6f4fecb28fb9ea279b0b375
SHA512 f98795a3c1ae43a29bb3fa507371aae601d7e7f93affef9db420c2265c8debe82f4443959c6bfc143f2b33368d2c934f27f6fe9424d98c49b030fc03c265ff67
TLSH
T118E060C38C8ED2EAA1632090221A90E00B03620C6FF0082062C8361EF793D021BDFB35
MD5 SHA1 SHA512 TLSH

Submit Download

state.rsm

Path C:\ProgramData\Package Cache\{77169412-f642-45e7-b533-0c6f48de12f9}\state.rsm
Size 1KB
SHA256 2e9f7e2e3cd515f6af785eea9af624a68a9679f86eb3fd99dae522b93157c0df
MD5 009d2541c98e0a88c78f32d3bebcbe84
SHA1 43ca01b749499484e3097c500ccc315a1544e69b
SHA512 fc06638ba22deab47f1238f196f0cfb2f13c4aebf8e94dec646e6cb0e8052b1ebaac303dfcade18883c69a71f731e69a23cd8bc54915e88eb7a074e6a8500052
TLSH
T11221A0659BF29026F3F3ABB069F9119A4AABBD522D31D41D01C5618F9F32640E924B23
MD5 SHA1 SHA512 TLSH

Submit Download

updatesNR.aiu

Path C:\ProgramData\UrbanVPN\updates\updatesNR.aiu
Size 2KB
SHA256 1d25c416381297bc6e48bfeb110b96f9ed653cf720c5a1e5ae75b119d9878d8b
MD5 a0b83c487fb8a0b0e3a81b679e290039
SHA1 dde1cf6495cd5bf47417cac2dbbbb75d63bda306
SHA512 07ee6cbbcf33c5ae93c60cf4f526b4f98a688db1e4f5377991d35a6b541b5e459c7faa332bf55ea10add0987dbb07043f5d43f0cd64b20fe4556f5a7ab4ce200
TLSH
T1705123D7E20157DD8E9B27E847191182BF7F61BC2B8858845123C1243311D5AE7FA77B
MD5 SHA1 SHA512 TLSH

Submit Download

tracking.ini

Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\632040a71cb8de62c9f15f5a\5.2.2.8569\tracking.ini
Size 84B
SHA256 a3c4d2c9467f621dceb6194d9a5c495b748d21b1f2990177c9add7fb23710009
MD5 b6229550d23f38e13a87ff0de73eebf0
SHA1 218324d7d6492ab13a0c7a87a1f353bedaffa557
SHA512 d9aa500c31265b0d32d0313d5b83b000d458098d1b0683e38ddb238e7a8ce8ed8bb0969978b3065a8784cebee8ab1938e4492f3fb73abc3f8a3ac584a1e5e39b
TLSH
T178A01228154130349C61169814178130343161C4323218D0134483415305B0087A4708
MD5 SHA1 SHA512 TLSH

Submit Download

{AA7B0A72-713E-4CB1-828F-57ABC2C1D644}.session

Path C:\Users\Admin\AppData\Local\AdvinstAnalytics\632040a71cb8de62c9f15f5a\5.2.2.8569\{AA7B0A72-713E-4CB1-828F-57ABC2C1D644}.session
Size 30KB
SHA256 45ebf234891fa027479e82b6fd8885c35af4a07b4dfa764605853b01dae2759a
MD5 729f568e9308f61445eb31dbde1ff2a2
SHA1 d1412071b8a89d9d35e39843c71ea459ccb99732
SHA512 fc0eb17130b5df863e0d434be2ad5769ab27d671b1f14cbb8dd5d8628367f7ff349ad9cde02b7a2b203b7e89e82b17b9070f44b89923991ffddf0cacd4cf06d6
SSDEEP 768:5IuhfMR4rG+4MSUWYg8nJHin6QWA7gKTqFM+AzR559Htbm9eo6DIL2P:5IuhfMR4rG+4MSTt6Zin6QWA7gKTqFMb
TLSH
T1AFE2072A72FC5156E2B2F690DFF59432AA67799A68394F3D11C6010963D1C0274C3FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 80625693cc7e872180333356782c21b0d13c2e813a2d9130d047fe989cb5fcd1
MD5 96c5512c9e8d62a741de9773a3af7a72
SHA1 e2b9fe2da31a2947920a37937bdff2802bfb857a
SHA512 77af266e89f47ea976eda5d8d15776c81609694d5d9b972d6aee2d9c87ebbd14fb889480e12ca0d4ae58210824ed5ab5ee40f3efff43087e17e681f4c8044b47
TLSH
T1A76182AD6B6F3ED9DB704BF9A1E148853BB7D7AA241F6F934080F3764AC234150611B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ab77a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ab77a.TMP
Size 2KB
SHA256 8e92abcf50ad48b6128ddbc73c85fb933f4b4e41af6f79799ba148c5b5beef91
MD5 4bae3580ffc36dc21745f99ff3a17c7c
SHA1 eb2e8497a23ce48d96aea62a61a601519fbbe1bf
SHA512 e803e709d987284705ebcd77b1b2a9fd79a5c3897d9a1ca88d2810f2ec2296faa53d2e8d0c4bac1a7fbef67910cfe1f2197d4b2afbd6585cb37bd7bfe22b7144
TLSH
T1855160ACAB2B3ED9C3314BFAA1E1498837F7D349241F9ED25080F3724AC270160A21B1
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1ac6c45ab8176f03f54c924a0c6151152089108b00b1bf91acaa6d2c9104701f
MD5 749ee183bf8c2139bd14c1335617fb71
SHA1 2a720658b7575080c885213376e8f13114ae83d7
SHA512 aee335b58fd050522b9de6a9dd2ca2a583af59dffded649b2dc08a628d9dd14c559fb73a6356dc7ea39c40bae7f8a5ed679a5fc5a2e0bc29646a56d5fa7bc9b9
SSDEEP 192:sxRNRyyM/jK1Ml8wCU/fJs2CK8bNOczoA8p4Wy/g6+WN1DIs/rISp4nETKI7zVIZ:sxRNM8U/fJslK8ONPy/5V7/rop2VQ1N
TLSH
T14662E856A5745D7B8DDBD219F995BB63D2F81463A2904E48AAFCCD1C00E7AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e43268cb483c8000fbbf77ac74e30e2298c49bced66a40648efca28196533172
MD5 a8896358a9774bf992bb68d4953648f5
SHA1 5a7ad1aa477220a553cdd5ee5bf926f882bc4054
SHA512 690aab1d094435a6d54f8aa83b5958edde0aefda640c98683802d4bcf77d9704e266cfe151fcfba7658c84e5a00407bbf97b033c6a202af10feb7907b7cc4be6
SSDEEP 192:sxRmRyyM/jK1Ml8wCU/fJsdCKlZTlbczoA8p4Wy/g6+WN1DIs/rISp4nETKI7zV7:sxRmM8U/fJskKLZbNPy/5V7/rop2Vl1D
TLSH
T10C72F956A5745D7B8CDBD319F591BB67D2F81423A1904E48AAFC8D1C00E7AED6203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 10ae2404297885d7e73c34c84c9d69265add5ae56439e453b6acb87794ec887b
MD5 2e5424d6628537c5fed53a2d5f3a6b78
SHA1 b24e8646487e3e89de365d715e1b0c48fc183416
SHA512 686a6d12fb4e6819cccc692d815128e16032a0cdef9570d772ea426c313e6b6c1d1fe9c1760245b353697a1f38876e540b1c634bf2a711f49321bab02d76ea30
SSDEEP 768:dhRAij7pLuL7ExWgg+fAJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVS13fYroPrO+:dhRAiVE7ExWgg+fAJu1jaxlfjjO+
TLSH
T147E2FE3B680CCB7E4F804A9DEC29BE9A6DE802CF56D8C95447EE490C03C67EB55164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5c4918e934bb54dab32ba79c7c82558b3501903de8beb9b59ae85710e4d084e1
MD5 c6a1eb773615f056e6bbfdb3a2187e5e
SHA1 367a7a0ea2c97d9829c3d2d662386548a98dc6d1
SHA512 f7a4169b7744aa6d181ac486f3bc675e0cefa41f2c0e457927df4f2e3f797875f38bc343af854e88bd872a649404aec2a67922790a7a48bfedee2a106bf0f9d1
SSDEEP 96:KRlH0lHVlHAlHElH+lHilHmlHkWlHilHvlHPglelGK4lDglclGclWl+l9lMl+lXl:ClUl1lglklelClGl7lClPlYlelOlDglY
TLSH
T1F4912800363F8280387E655C8478A52F928375A73118A93B7FE821735F67E1A5DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 67651a9806987ab575af3163b615cea0b1f2b37cf4017caabc7170e986070f82
MD5 b70f28dab3e23b15833de24d082b7298
SHA1 ae16e023bd1315d29452e7ef26854e672739f7f5
SHA512 d587e7e5ff6bba575da394bf64d74ea4b1be328fc3510c6dd32825eb5a55bd2b577ebbc4a6f6b453b356f422e3ee1e2ac06d3d401900f7f551d59a6398f29c16
SSDEEP 768:qrv+4UNbdd3d138iJjzzNHXmTWTbc+HiBY:qbsbX3d+IzVeWn1CBY
TLSH
T1B003AE31ECA9AA379EF69B98A40B7A037FB4115391C80A98C9DD6F4D018B49D131BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 90fb695261695bb179f6ee545557306c7c9c53efc55b617445157c52356f8782
MD5 be613ee06aa34cbde6cbfd783a59db47
SHA1 90db4bffb46d510f4bf7886053a6aed96a654b04
SHA512 32a25d4d2de4c78d13135d882b6102004eb9d33afcffe2eba7ea0f1b61ba1a2700b7ac81bc605d7f6284c958c687ac2dcc4f4d829e1319407802af543bd5105b
SSDEEP 768:arv+4UNbdM3ElCiJjznNHXmTWTbc+/beVH1SvyZ:absb+3VIzxeWn1DEH1dZ
TLSH
T12003CF329CB98F37ADF69688754BBA573EF8116385C40B88C8D96F4E428748D170BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7401da828805becbf6f211a60e249720d1d2fb0c97ef1b106814cbe51ceb65b6
MD5 cd51228c246c242c811148341dad7e25
SHA1 6628434558c64de20b8084ad6f0a3134b860b94b
SHA512 c812d92ac66383cbe848dfc2fccfdb8702fbaa1ac8649dcd01c661255111ceac3bbb27a66738c6be17933920ef562e29d81a51a8f6229fcb70e09808f9428148
SSDEEP 384:nQZcIu38N3L/c6O0jrAzRfY9bY2RzrA9QPlLJQXmIkdP9IimIMWEfMbc+HiMuvzH:uu3U1F8iJjzzNHXmTWTbc+HiD184poaN
TLSH
T10DF2BFB1ACA5AE779DFA9B84A90B7B02AEF4516391CC1988C9DD7F0E014315D031BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6960b75f2073181ee814904e3eedf09c61ac3e698b7cc3de02c78282642ba098
MD5 515188a5c2bdca424f6c794085d84ed3
SHA1 131283efc93a6a3a841e335a8aaa68d7a75c7af1
SHA512 37866996dc5ed547e18311a8cbd36c2a08bab38377157cb06567617235b78a94a2f3b8b344003e202c1d65197d3762f68d6c96aef4f7de5c2e1434a14b5cd4f1
SSDEEP 768:Lrv+4UNbdM3K2aiJjzzNHXmTWTbc+eieVH1SvyZ:Lbsb+3gIzVeWn1REH1dZ
TLSH
T1BC03B0319CA99A37ADF65BD8744BBA077FF8116381C80A94C8D92F4E428B49D031BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fffa3a9e-2627-42a0-8609-9649e2ac4523.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fffa3a9e-2627-42a0-8609-9649e2ac4523.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5a6b9c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a6b9c.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

7b0a8a73-dd3f-4a44-975f-4906214abeed.tmp

Path C:\Users\Admin\AppData\Local\Temp\7b0a8a73-dd3f-4a44-975f-4906214abeed.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

banner.jpg_1

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5988\banner.jpg_1
Size 17KB
SHA256 6cf8749ec1e8707785d80385943202d4ae23938b685c9a51be20a7b3f5ff7082
MD5 1728b929d3842941cccaf94722bb549e
SHA1 b5c3efc573cc09ea5c28c569cf72675165e2fe43
SHA512 7bd02dbc6e03c6c71dbcbdb31a4bc667ddb3c4f9c0a26918c82624b1a06b4f9e938a96d667957a43b98a65ad230eb02e7f0cd88ff92b583cca4a94a54b14a31d
SSDEEP 384:mZXAlzy2yXbl57FPRvBOfQuBhuII47ozAiX0l5Wxlb:mZX0yLD7FPREhuIRcAv6lb
TLSH
T1DE82D095C352A0E89CD865EF4CF93604E33610D6E622F322CEE2B8C5E76909D319F438
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dialog.jpg_1

Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5988\dialog.jpg_1
Size 50KB
SHA256 38baa3126fc159e33257caa77cc277993bca5233cd9ff45683ac963e80ddcbdf
MD5 4107146facf250b451d6eb8fedb4371a
SHA1 816223ecc1e3e7db923b975a0d80e05a65f7d6a5
SHA512 44964e7ad0f95adcc75306eb5149e8642c75ba55297e9714e8d109142b79810b9d675877e404de2ebd5f7455d1c684b2b9928e5ad35f992d15a60d8d9582fc4c
SSDEEP 768:ROnAmtqd0Xw49mY7zbVyBFOQs8SWBMvcSjRP98YhBss2Fju063nVt6F/OvZ:ROjtqD4QY7zber4c8RP+uZ2b6Xv6JUZ
TLSH
T1C033BFB5F3DBF359AB0B01AC823EBDB3071298D519E48643246B1E02D268F70719797D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INA76DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\INA76DC.tmp
Size 1.1MB
SHA256 7d32c3f22aba69ab7c881b54aa40cc92710630d9e49f861eb1535199780b4f52
MD5 948cdfa1cf23767bc780e1352fcdee94
SHA1 45a8371426110ff8e809d5c21e356ea535232872
SHA512 db5289781f56f3ed809ab7993d2e9d8e018d98e8bf74bbf287ed37dcd8102d75ebeb81d5ee537d103ac97a090d3ec4f9944164d03c518d14a89de2de0d3887b9
SSDEEP 24576:UUL/equeyM0i+B7Q3ImKKF+Oh0lhSMXl8Gek9ApQhqAfEEx4D9sF:ieyMlqQtKIOsGr9ApQhqAfEEx4D9sF
TLSH
T1A245F724EC2E8572FE5F11729617772BE06C1DD01B7058DF82A9C8D61D722CBA239F86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI770D.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI770D.tmp
Size 1019KB
SHA256 15c35c5abf7bab8d1375f5622e31da14fd027ae1046b8a6ddfd74263fa34eda6
MD5 2330ebbe491c6026af5e8853f3692798
SHA1 6c62d81f6c90046714705bec931815a908b760ac
SHA512 81747ead7869f68e499a53537588d35485b5fd2b4505856cd589bca1f7296d971e78f3fd57a1c1d931dfe6c2668888b26eff49a96ecd740ecd1b271eb7058201
SSDEEP 24576:T21SlOwxeXfwNTELVJh0lhSMXl3SG5vHqU4duDfCK:ToS9xeXf7LKnSG5vHqU4duDfCK
TLSH
T114256C203A4AC436F6AE01F2693D9A6BA07F79BA1B7144C753D4BD7A28704C25739F13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7877.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7877.tmp
Size 1.2MB
SHA256 6e7cdab18e1f705c0ea56a565577db0389ece2b5a4e0f31d3063e9103f59fbee
MD5 c9ef0378879c57a38c075bb28b88fcab
SHA1 dd27d17d691ffddaadd8bd6de532bc9f8b2c4a3e
SHA512 94cca46aafe7138904a79693e0c97e0d72a0542e4d7a8a6778b4d4f0e68aa3dd90e7dbc0b34832a8875b10f32c3ca2bbaab446da0689c74ca295af4490c6783f
SSDEEP 24576:AMsSFgim2N2/YBtbDeC5sBAbwjHtAR5ddfKFT3Lt4gGLAl+quHMlKJM4L1aLKc7W:AliN15sBAbwjHtS5DfKFT3zGLAl+quHH
TLSH
T1EF450931AD7C457AEF6F89B096575226F95D29D21BA088EF82E0D44722311D3E331BCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7A2E.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI7A2E.tmp
Size 917KB
SHA256 0fa9b28d3bb8e455ad61735f5259d5d9b8f65bcefa44f83f69db8a4ca451e5bd
MD5 afa8190a561a082dcc094e9ff8abdb4a
SHA1 3817097816d20ccbe8754e6c58bbbde937af9a20
SHA512 3deb8f142dc287246ab17cf45c1c501ffe39cd1e089d6b6d90cac8d958f873764615cdaf37be08cda19bc8354ca9ee94a8518d425802d3a289ea74a364a0f952
SSDEEP 24576:SQemY/mbo0ha/8EoUVSwAnA7h0lhSMXl0uVGgwiLFpZIH:SQXo0pMVSPDk2GgwiLFpZIH
TLSH
T1AE157C71268EC036F26E91B02B3D8E7F911D6E764BB108D763D4AD6A56314C2433AE37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI86DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI86DC.tmp
Size 334KB
SHA256 3311ac863a98378e1b5ade58c814158f350067c2a96a095eee63ba19b6ef2e22
MD5 67425672440ac762d3dd7c1cd3746c7d
SHA1 3332b4c89cb6ad8acee47904446dd3f8d76130be
SHA512 484c46ab834f8732ca7c0afc77fbce68f5cba1783ec2889e4283fe6ce76b569b06501d47f14ed8aaeaebcd0c480c45bbaed18eccabd64e22f5a1319cc1e31dfc
SSDEEP 6144:DsbvBbhOr4+T1lqK0rklph0lhSMXlBXBW/+BOA:Dsbhwtl6klph0lhSMXle+EA
TLSH
T12E74B020A956C033D65E0E307D6A8FEB9A3D5EA14FA164CF73DC2DB54E702C16739A09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

URL3F4C.url

Path C:\Users\Admin\AppData\Local\Temp\URL3F4C.url
Size 65B
SHA256 adf4707340269432553415ee4008223152c58a15118a54ab88d596a0890e7e31
MD5 2a877bcf3be14b26e0a97abc9dc6898b
SHA1 2a718613777d7512deb1a6099a8ebddc3c368fe8
SHA512 e6348bcf86c09c67ae246b10cdd71b4cffbe4951256f3edc3df4b21a3c2e42ec73464136dcec3359e5edfda040d7b481eff2f5fdef99b88bdc08c399da5f743c
TLSH
T107A022C3C20CC0FC8A82C2CC2030C200C80320E0C282C0C083C0BE80088B02302C0A8B
MD5 SHA1 SHA512 TLSH

Submit Download

Urban_TOS.html

Path C:\Users\Admin\AppData\Local\Temp\Urban_TOS.html
Size 17KB
SHA256 f284323553254d0915c06484ea6055bb4a67ee0125b4d81a7656aca09e80f527
MD5 89fc41bcfb4be7baf38473b332be83ba
SHA1 6a193e29f0eb32848aff45c1f35c1d10248dbdda
SHA512 c31c287eb7dbada072c567fcf2d71467e5671089e2d681c6a74d4d285321e67d8c476074d2d5f90eb167e23c49db2d53f44c326089ec2f7a6ea5b1f1a38737c6
SSDEEP 384:ZgovMHrC6LlrArNP68eXU04mNAgpUieLCTvHWe4Ps0DYRwc8u:/v2rCelM6X3RnPISHF
TLSH
T18382EA7FE34613B205C212557947A9E0F72A00686BF6A67134DA802B23D6E78437F779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd_vcredist_amd64_20260908015110_000_vcRuntimeMinimum_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908015110_000_vcRuntimeMinimum_x64.log
Size 2KB
SHA256 6b551497c35be06a12280fca408fdcdcc50fa52540aff3103b4006818ba3d0dd
MD5 784992778f080da55f9db6bf9dea2bac
SHA1 fa3a4b32649551d8e7b7743c81edfdd60dd28735
SHA512 2fb6738b7b1a5afeeaf7f15c456a168f577af193f17491d30131e226f4e1d53f67de495cccc451d1a61a7aaab099105b086a702a755b8497872a05e66446cbd1
TLSH
T11541E6552AD9090AB1B797479EF3C0729E73FCF26874CB0C2289421A4767D006D6C7AE
MD5 SHA1 SHA512 TLSH

Submit Download

dd_vcredist_amd64_20260908015110_001_vcRuntimeAdditional_x64.log

Path C:\Users\Admin\AppData\Local\Temp\dd_vcredist_amd64_20260908015110_001_vcRuntimeAdditional_x64.log
Size 2KB
SHA256 382556549b56e0efe29ddb6c9b7bdbe268749cb8ca5f3622aecb064c0b55682e
MD5 417c61f3852864a9f9cc5cc8aeaaefd9
SHA1 4750e602f34c48508cc9a721be214cf3c1bb72ec
SHA512 a0b17287e946207149a8bcc42af66ab28c76bf3b0cea7d49002881a8b282cac4fc7491e178731ec4b19f214093f237d92245360041133fa6c80a6fadae8f4a18
TLSH
T1C941E4212AE8084AB2B757879EF3C4639F73FCF57874CB0C224542194667D005D587AE
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4552_59538208\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UrbanVPN.msi

Path C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN 5.2.2.8569\install\83653A3\UrbanVPN.msi
Size 9.3MB
SHA256 3849111d68c51995d3c802130bdccef00b59afe13480c508a824442de91ca985
MD5 5810b5ecb8647abeadbb52a3db542ced
SHA1 fbfc59ab8c410388976e9b20a0797a8c6b2e15c3
SHA512 6dc7263b03622af1ac8b690b94d17aaf22b18b813533f3a5f66fefb617ea6a73282bca8f031cc8f34369cd87afe76f156b8aa23b396cd9298fe818882c061b86
SSDEEP 196608:4FVhsQHOFT3FykUwHMXBiJAISpHaaaa8arab7aa7a:4rhsQHOFT1y24BiJ
TLSH
T114A6AF20BD5EC036E66F01719A2AAA2BE53D7CE10BB048CB53D4B8AA1D315C39735F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\Users\Admin\AppData\Roaming\Urban Cyber Security\UrbanVPN\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2022\VC_redist.x64.exe
Size 24.3MB
SHA256 814e9da5ec5e5d6a8fa701999d1fc3baddf7f3adc528e202590e9b1cb73e4a11
MD5 689d09bce45c75db883db7e78b6f4e9b
SHA1 ba92a00f0f55dcae85c1bbd098efe606bd080b3c
SHA512 4db5078fdd9eb9ce00a1b6195a67c779a1d3c719de0fbd4729adbdac2d8ca442cf4e0a31aa40d213f29617ec073f1a7e42570dcc2f931eb9534c45f1ec6de253
SSDEEP 786432:moKpx5hYBug51MMlQi7PZdJXiq1+N76JupzS:Upx56Bu61FZPZdxQcUzS
TLSH
T1B9473332E418406BEBB234779DAAE5312E7CA62C231149E6D3C8ED4D6B7919313FF611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2373.tmp

Path C:\Windows\Installer\MSI2373.tmp
Size 329KB
SHA256 a64119f041734f2eca66cb32ad397afeae9e793f3eab144dfdb1b48692f2ce6f
MD5 4595a3ee93deb2ffe37d7fd86792115f
SHA1 efe80ce610b4f4e456f1c99110e6749c5a87d48f
SHA512 0768af55f3d04ea0b41de2609558fb3234f9f7cf80b44e8815abe301dd4c972d49427107b7829939ac0a1c6925a075a524a085d248ffa9c9ee1b8a509c7a494a
SSDEEP 6144:xAm3R1zPBgbxjOka7nU8mlxMFmm1v9AGhWnC:xn3eb1a7nxEAzv3
TLSH
T1BE747C19B3A504B8E0B7927CC9A35906E7B67C160361D6CF23E046562F33BE4993EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3B7B.tmp

Path C:\Windows\Installer\MSI3B7B.tmp
Size 423KB
SHA256 eb21efa033f38f24d87c1c259055a2618168268881be6ae06d734450fdf65f82
MD5 18cda9f5769af8d162f93889de623514
SHA1 cbb2d0ef2baa765715c67fcd9766f2fea3af1fa8
SHA512 bcca4f6dd4acf4a61b36ce5ad058c15535812de7362950959ff0373352b640fc8121b64523be6fc785aa603fe3441fce8a8b589a7ef9b11838eca6ff9b24cc2e
SSDEEP 6144:KVBkP0VtAJfL8A5elIDqacjFxqavMGuaCwph0lhSMXlBXBW/k4p6GMhyB:4WMIWhZ7Cwph0lhSMXl2k86yB
TLSH
T1EA94BF20B98AC032D61F05705D78AFAA8B2D7D614FE494CB93DC6CBB4D725C25B35A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wireguard.inf_amd64_bd22474b85ad1b6f.ini

Path C:\Windows\System32\DriverStore\FileRepository\wireguard.inf_amd64_bd22474b85ad1b6f.ini
Size 428B
SHA256 fd14cae8f5845e610d11255e0111441ec61c3a786cea5a9a94cb11c6c633bc8a
MD5 2cffc15ba58b427ae72dd2c733f3c80d
SHA1 4a12c94956b8029f9754ba6904b6213103a25f25
SHA512 ae0d855b42434845252197f2a4efec2d8420525da5be14568800f15bd06abc27e85b4ec9213390bd62cd99779f9c4856df0691fd1f81eef14f70eff5f8ca7c62
TLSH
T1D6E02B82367CD18D9580720CA339373BA91537E707A5E32ABF90849976C603ECF89708
MD5 SHA1 SHA512 TLSH

Submit Download

wireguard.inf

Path C:\Windows\Temp\6906ce50a20e297c57bf85d0531e6f1953640cdbe8a986ed490b2a9cc3d779bf\wireguard.inf
Size 2KB
SHA256 079e58e9b00de894557bae8feb40cc578070376a52971bd733d74e8955b3b126
MD5 945faa0eff8b1a73afd3255e1f28aa3a
SHA1 cfde5c7ce0f79fece868606bf68493949a35d38b
SHA512 3f0850e254679e98769de5339a0114e44697108ef079bb3fdc1698d1a27fb63aec240ca17ecc72026a4c9d0f85b54ae1b31625691b656cbc962c15b4c78de213
TLSH
T1D74146E5B5E51E6D38E23232B33A7C82758C134100ED306FB58D8946740FD6DE6199FA
MD5 SHA1 SHA512 TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{5AB5BC3C-16B9-46AB-BD2E-DBDC4FD929E1}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{5AB5BC3C-16B9-46AB-BD2E-DBDC4FD929E1}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab2C04DDC374BD96EB5C8EB8208F2C7C92

Path C:\Windows\Temp\{5AB5BC3C-16B9-46AB-BD2E-DBDC4FD929E1}\cab2C04DDC374BD96EB5C8EB8208F2C7C92
Size 5.4MB
SHA256 8265bab100e281ddd366a9a435aee439bb87a1fe848fbfce0881449c4f08e485
MD5 92f06ebd6d7dd8fc4373a257ba81e19e
SHA1 479f3a9fa2d3fed500088812f9201197adf01e17
SHA512 76eb034b06f05a0dcbe62843d791a28959c9354c5e290b90a4320451ba0d5081432f2f6581fb16aedde1fbdc7a60b85c0d7f13907ab7d5e563c57dd2aa6fb9ea
SSDEEP 98304:aaaTUerJ34CXBLnYanuGjC1L9qjYBV0fVXi1sduXPPLg92OlPZ/GU0Zfxda5cg:zrKtZnYanuGjCB9qj1f2sdZ1GUcY5cg
TLSH
T1D846335CC618D3D6647AB117D57A83860DF429EF66231E84DE731F96838E24BB3A380D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cab5046A8AB272BF37297BB7928664C9503

Path C:\Windows\Temp\{5AB5BC3C-16B9-46AB-BD2E-DBDC4FD929E1}\cab5046A8AB272BF37297BB7928664C9503
Size 967KB
SHA256 78cd0d63fb93470f11a300d79c5bafe4554142035126068710d6583fc23d49fa
MD5 3ec3d0ebf9e94535ab326fb3ed1ebefd
SHA1 5331e4062617df4cfe8dd1fed67a39e1778c3e86
SHA512 c3f4899d2bf3079485c5c47c8a910023b654e0ae4821ced54b995df5626692551e12fecdc65551d56d9a99f8e5dcdb6176011afe97dc45a734c192834ed0485a
SSDEEP 24576:Ai3yPptQc8pzIXCH9T6hJuAsx4lYNMEY8iSoujlz8V6ZiUc:AiI8pzIXCHR6ru/xqE9iqJ8kip
TLSH
T1162533818C7D724FF250195E6B82EA7A042F6EA7DC57607662F660C614C27ACB13C4FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeAdditional_x64

Path C:\Windows\Temp\{5AB5BC3C-16B9-46AB-BD2E-DBDC4FD929E1}\vcRuntimeAdditional_x64
Size 208KB
SHA256 a4b5cd38dbac2d9588bb15d6b02b24a05c340c2c0a10d1ac86037e6dd14262c5
MD5 c41d1aa655205cb772e3aeb0de9c14df
SHA1 a3d95bdfa9c9552536adb589f66ccf28dfeabb1c
SHA512 dd5b8f32021bcff98f2a96582d4cfc28571bef870ca3b1d6f7e58d6d4e18f12eb91063f2524094beb699396814109e39f87183e9935742b9579bae75f5f32f52
SSDEEP 3072:C9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriT9g:slaZeKFxCnBheIdlux
TLSH
T1E524AF12B5808033DAFE1A351178DBA15F3D7E608F544A9B2364B6AD1E717C08F3A9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcRuntimeMinimum_x64

Path C:\Windows\Temp\{5AB5BC3C-16B9-46AB-BD2E-DBDC4FD929E1}\vcRuntimeMinimum_x64
Size 208KB
SHA256 59a148da299c73d6bd4ef9a8e99736c3d3eabb3b9f895ad8ab183b657516cc22
MD5 cbb2aeab99bcc3085738c1c41fdf3225
SHA1 9462fcbb04046d68df7250f5124e79c269f771b2
SHA512 aec8238b7d7a4727b1f3fdcd5d3c6064bf72af6da5d8ef6542fe5fd97b8e24b7d15540426fae029a628d7e160f9fb31fc482edccc416d970f93656ecad0fd5e7
SSDEEP 3072:S9laht5Xel69YGnfxC2WB/bEPcefrKROjibDPxriTYBp:claZeKFxCnBheIdluO
TLSH
T1B824AE12B5808033DAFE1A350578DB615F3D7E608E54899B6364B6AD1E707C0CF3AAB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VC_redist.x64.exe

Path C:\Windows\Temp\{8C606ADC-23E8-48B1-BE25-6EA3201D7F10}\.cr\VC_redist.x64.exe
Size 670KB
SHA256 1ec6ded595b12262d8bfcf8436046c9d84febff424924cb839a1946dad76ca4e
MD5 261f741c93973d184d4fccf833f0c075
SHA1 cb7846fc45cc545b3ac6ab0aa3425461e219b196
SHA512 90ca6a11c6bbd5f97d1ed146da5279bf40330bf9020b40eb816ede0d914ed4d769e9c48cb8c839924700dec818d4f818f89e6d6afbc7091e2a2809ebe099da81
SSDEEP 12288:Z3mgqnIZuYfCYqFet4CovkM7pu1nEMSgKZLrfDDIcbMZ3MyGb:Z3WnIZuMCxezot7ohEDfDBMZ8yM
TLSH
T120E49D32A5614033F7F10573B928A6303E7CE3282B51C8A9D7D4AD1D7EB4892A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.rtf

Path C:\Windows\Temp\{9F2BF2DF-BB04-4CB9-A347-2E5848460D57}\.ba\license.rtf
Size 9KB
SHA256 8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b
MD5 04b33f0a9081c10e85d0e495a1294f83
SHA1 1efe2fb2d014a731b752672745f9ffecdd716412
SHA512 d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685
SSDEEP 192:H8kZ1UVDWkiWZTIsp/4hghFF1Qf4lCfnEtHixEGx736wHqItfSpOtJ32:cM1RWZMi/zzlOnjt5HLoa2
TLSH
T13F12A7A8234783D103D213D7055294C1B71F0BF6AE7AF95C34E4D53826E2E6CB6B91E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thm.wxl

Path C:\Windows\Temp\{9F2BF2DF-BB04-4CB9-A347-2E5848460D57}\.ba\thm.wxl
Size 2KB
SHA256 70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce
MD5 fbfcbc4dacc566a3c426f43ce10907b6
SHA1 63c45f9a771161740e100faf710f30eed017d723
SHA512 063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e
TLSH
T11F519B6778CF639028335125EAD2966A6920C5DC923F2DF1FC4A914B838D522A373F57
MD5 SHA1 SHA512 TLSH

Submit Download

thm.xml

Path C:\Windows\Temp\{9F2BF2DF-BB04-4CB9-A347-2E5848460D57}\.ba\thm.xml
Size 8KB
SHA256 f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916
MD5 f62729c6d2540015e072514226c121c7
SHA1 c1e189d693f41ac2eafcc363f7890fc0fea6979c
SHA512 cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471
SSDEEP 96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
TLSH
T1D30259B546DDB801D232FB1166E231D27F126971C0C46E59F90C2AFB5FE1140A8B72BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{9F2BF2DF-BB04-4CB9-A347-2E5848460D57}\.ba\wixstdba.dll
Size 191KB
SHA256 a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
MD5 eab9caf4277829abdf6223ec1efa0edd
SHA1 74862ecf349a9bedd32699f2a7a4e00b4727543d
SHA512 45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
SSDEEP 3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
TLSH
T103149E11B5D0907AE7FB1A385938B5216D7FBA201B60C99E17589D6F2DF02C0AF35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1152-472-0x0000000000640000-0x00000000006B7000-memory.dmp

Download

memory/1612-473-0x0000000000640000-0x00000000006B7000-memory.dmp

Download

memory/2420-1038-0x00007FFEE6F50000-0x00007FFEE7559000-memory.dmp

Download

memory/2844-470-0x0000000000640000-0x00000000006B7000-memory.dmp

Download

memory/3812-468-0x000001AFFEB20000-0x000001AFFF4C4000-memory.dmp

Download

memory/3812-725-0x000001AFFEB20000-0x000001AFFF4C4000-memory.dmp

Download

memory/6576-1444-0x0000017D7B570000-0x0000017D7B571000-memory.dmp

Download

memory/6576-1456-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1455-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1454-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1453-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1452-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1451-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1450-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1449-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1463-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1465-0x0000017D7CB40000-0x0000017D7CB41000-memory.dmp

Download

memory/6576-1464-0x0000017D7CB40000-0x0000017D7CB41000-memory.dmp

Download

memory/6576-1462-0x0000017D7CB40000-0x0000017D7CB41000-memory.dmp

Download

memory/6576-1471-0x0000017D7CB40000-0x0000017D7CB41000-memory.dmp

Download

memory/6576-1470-0x0000017D7CB40000-0x0000017D7CB41000-memory.dmp

Download

memory/6576-1469-0x0000017D7CB50000-0x0000017D7CB51000-memory.dmp

Download

memory/6576-1467-0x0000017D7CB40000-0x0000017D7CB41000-memory.dmp

Download

memory/6576-1466-0x0000017D7CB40000-0x0000017D7CB41000-memory.dmp

Download

memory/6576-1474-0x0000017D7CB50000-0x0000017D7CB51000-memory.dmp

Download

memory/6576-1473-0x0000017D7CB60000-0x0000017D7CB62000-memory.dmp

Download

memory/6576-1472-0x0000017D7CB60000-0x0000017D7CB62000-memory.dmp

Download

memory/6576-1477-0x0000017D7CB60000-0x0000017D7CB62000-memory.dmp

Download

memory/6576-1478-0x0000017D7CB60000-0x0000017D7CB62000-memory.dmp

Download

memory/6576-1479-0x0000017D7CB60000-0x0000017D7CB62000-memory.dmp

Download

memory/6576-1481-0x0000017D7CCB0000-0x0000017D7CCB1000-memory.dmp

Download

memory/6576-1482-0x0000017D7CCB0000-0x0000017D7CCB1000-memory.dmp

Download

memory/6576-1484-0x0000017D7CCB0000-0x0000017D7CCB1000-memory.dmp

Download

memory/6576-1483-0x0000017D7CCB0000-0x0000017D7CCB1000-memory.dmp

Download

memory/6576-1485-0x0000017D7CB60000-0x0000017D7CB62000-memory.dmp

Download

memory/6576-1496-0x0000017D7CD40000-0x0000017D7CD41000-memory.dmp

Download

memory/6576-1497-0x0000017D7CD40000-0x0000017D7CD41000-memory.dmp

Download

memory/6576-1499-0x0000017D7CD40000-0x0000017D7CD41000-memory.dmp

Download

memory/6576-1498-0x0000017D7CD40000-0x0000017D7CD41000-memory.dmp

Download

memory/6576-1490-0x0000017D7CD30000-0x0000017D7CD32000-memory.dmp

Download

memory/6576-1489-0x0000017D7CD30000-0x0000017D7CD32000-memory.dmp

Download

memory/6576-1488-0x0000017D7CCB0000-0x0000017D7CCB1000-memory.dmp

Download

memory/6576-1487-0x0000017D7CD30000-0x0000017D7CD32000-memory.dmp

Download

memory/6576-1495-0x0000017D7CD40000-0x0000017D7CD41000-memory.dmp

Download

memory/6576-1494-0x0000017D7CD40000-0x0000017D7CD41000-memory.dmp

Download

memory/6576-1493-0x0000017D7CD40000-0x0000017D7CD41000-memory.dmp

Download

memory/6576-1491-0x0000017D7CCB0000-0x0000017D7CCB1000-memory.dmp

Download

memory/6576-1457-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1458-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1459-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1460-0x0000017D7CB20000-0x0000017D7CB21000-memory.dmp

Download

memory/6576-1446-0x0000017D7B560000-0x0000017D7B561000-memory.dmp

Download

memory/6576-1447-0x0000017D7B560000-0x0000017D7B561000-memory.dmp

Download

memory/6576-1445-0x0000017D7B560000-0x0000017D7B561000-memory.dmp

Download

memory/6576-1433-0x0000017D7B560000-0x0000017D7B561000-memory.dmp

Download

memory/6576-1721-0x0000017D7CD80000-0x0000017D7CD81000-memory.dmp

Download

memory/6576-1719-0x0000017D7CD70000-0x0000017D7CD71000-memory.dmp

Download

memory/6576-1435-0x0000017D7B570000-0x0000017D7B571000-memory.dmp

Download

memory/6576-1431-0x0000017D7B560000-0x0000017D7B561000-memory.dmp

Download

memory/6576-1432-0x0000017D7B560000-0x0000017D7B561000-memory.dmp

Download

memory/6576-1257-0x0000017D78650000-0x0000017D78A92000-memory.dmp

Download

memory/6576-1258-0x0000017D78AA0000-0x0000017D78CA2000-memory.dmp

Download

memory/6576-1214-0x00007FFEE6F50000-0x00007FFEE7559000-memory.dmp

Download

memory/6916-1734-0x00007FFEE6F50000-0x00007FFEE7559000-memory.dmp

Download