PUP.Turbo VPN

By CagedTech in Potentially Unwanted Programs

Published: March 18, 2022

Last updated: October 13, 2026

Threat Scorecard

Popularity Rank:	560
Threat Level:	10 % (Normal)
Infected Computers:	55,388

First Seen:	March 17, 2022
Last Seen:	October 12, 2026
OS(es) Affected:	Windows

The detection of PUP.Turbo VPN on your system indicates the presence of a potentially unwanted program (PUP) that may compromise your computer's security and performance. It is essential to understand the nature of this threat and take prompt action to remove it from your system.

What Is PUP.Turbo VPN?

PUP.Turbo VPN is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may exhibit unwanted behavior, such as displaying advertisements, collecting user data, or modifying system settings. While PUPs are not typically malicious, they can still pose a risk to your system's security and stability.

How PUP.Turbo VPN Operates

PUP.Turbo VPN may operate by installing itself on your system through various means, such as bundled software installations or drive-by downloads. Once installed, it may run in the background, consuming system resources and potentially collecting user data. PUPs like PUP.Turbo VPN may also display advertisements, modify system settings, or install additional software without your consent.

Symptoms of Infection

The symptoms of a PUP.Turbo VPN infection may vary, but common indicators include unexpected advertisements, slow system performance, and unfamiliar programs or icons on your desktop. You may also notice that your browser settings have been modified, or that your system is experiencing frequent crashes or freezes. If you suspect that your system has been infected with PUP.Turbo VPN, it is crucial to take immediate action to remove the threat.

How to Remove PUP.Turbo VPN

Boot your system in Safe Mode with Networking to prevent PUP.Turbo VPN from running and interfering with the removal process.
Run a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of PUP.Turbo VPN.
Uninstall any suspicious programs or applications that may be related to PUP.Turbo VPN.
Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any modifications made by PUP.Turbo VPN.
Reboot your system and run another full scan to ensure that all remnants of PUP.Turbo VPN have been removed.

Conclusion

Removing PUP.Turbo VPN from your system is crucial to preventing further damage and protecting your personal data. By following the steps outlined above, you can effectively remove this potentially unwanted program and restore your system to a safe and stable state. It is also essential to practice safe computing habits, such as regularly updating your operating system and software, using strong antivirus protection, and avoiding suspicious downloads or links, to prevent similar infections in the future.

SpyHunter Detects & Remove PUP.Turbo VPN

File System Details

PUP.Turbo VPN may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	TurboVPNLauncher.exe	9f5ef8f6a7e06a46ebb02e7066c660f2	2,531
Name: TurboVPNLauncher.exe MD5: 9f5ef8f6a7e06a46ebb02e7066c660f2 Size: 598.34 KB (598344 bytes) Detections: 2,531 Type: Executable File Path: C:\Program Files (x86)\TurboVPN\TurboVPNLauncher.exe Group: Malware file Last Updated: August 27, 2026
2.	shieldManager.exe	99b972a717c6728c5c863c51d20590ba	1,284
Name: shieldManager.exe MD5: 99b972a717c6728c5c863c51d20590ba Size: 1.35 MB (1354056 bytes) Detections: 1,284 Type: Executable File Path: C:\Program Files (x86)\vpnshield\dep\shieldManager.exe Group: Malware file Last Updated: July 28, 2026
3.	turbo_vpn-service.exe	cba8718cf01a7d489d00695bed5011f6	1,284
Name: turbo_vpn-service.exe MD5: cba8718cf01a7d489d00695bed5011f6 Size: 624.8 KB (624800 bytes) Detections: 1,284 Type: Executable File Path: C:\Program Files (x86)\TurboVPN\turbo_vpn-service.exe Group: Malware file Last Updated: October 10, 2026
4.	shieldservice.exe	8331134761d0db7b3196280e8fb9c202	1,189
Name: shieldservice.exe MD5: 8331134761d0db7b3196280e8fb9c202 Size: 4.51 MB (4515608 bytes) Detections: 1,189 Type: Executable File Path: c:\program files\vpnshield\dep\shieldservice.exe Group: Malware file Last Updated: July 28, 2026
5.	TurboVPN_setup.exe	df96bc092b1ab5a0408d6e9f1a73b040	569
Name: TurboVPN_setup.exe MD5: df96bc092b1ab5a0408d6e9f1a73b040 Size: 26.1 MB (26106976 bytes) Detections: 569 Type: Executable File Path: . Group: Malware file Last Updated: October 12, 2026
6.	TurboVPN.exe	781ae32e7d42865284b8a21e83e7fedd	528
Name: TurboVPN.exe MD5: 781ae32e7d42865284b8a21e83e7fedd Size: 7.71 MB (7710368 bytes) Detections: 528 Type: Executable File Path: C:\Program Files (x86)\TurboVPN\TurboVPN.exe Group: Malware file Last Updated: September 23, 2026
7.	vpnshield_install.exe	7b4f897f3c16309d64f5ec8eef3f7625	104
Name: vpnshield_install.exe MD5: 7b4f897f3c16309d64f5ec8eef3f7625 Size: 9.63 MB (9631736 bytes) Detections: 104 Type: Executable File Path: C:\Users\<username>\Downloads\vpnshield_install.exe Group: Malware file Last Updated: May 25, 2023
8.	vpn_shield.exe	c7d27c7a545e589ba02068ea0b034978	81
Name: vpn_shield.exe MD5: c7d27c7a545e589ba02068ea0b034978 Size: 18.45 MB (18452804 bytes) Detections: 81 Type: Executable File Path: C:\Program Files (x86)\vpnshield Group: Malware file Last Updated: January 29, 2026

More files

Registry Details

PUP.Turbo VPN may create the following registry entry or registry entries:

File name without path

TurboVPN.lnk

HKEY..\..\..\..{RegistryKeys}

Software\nnovative Connecting\TurboVPN

HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}

TurboVPN

Directories

PUP.Turbo VPN may create the following directory or directories:

%PROGRAMFILES%\TurboVPN

Analysis Report

General information

Family Name:	PUP.Turbo VPN
Signature status:	Root Not Trusted

Known Samples

MD5: 8c44740052fb786dac00742c07e9a174

SHA1: ed9f5b23ac80a7984e3721f00638c18ce77c450a

File Size: 7.24 MB, 7243416 bytes

MD5: de549711c878dbafdad8b4af411a6c23

SHA1: c09a740c9337cebec8e2955124bd737740142db3

File Size: 1.51 MB, 1511208 bytes

MD5: 646056d5dad9f7202ab51dfd31a97103

SHA1: 4b141385ba8de4fef3389004ac88e28947acc010

SHA256: 0F6E484109123A81102A8738D8BAE45EEA4E39370113B6D01C742B30E2A637BB

File Size: 3.14 MB, 3139584 bytes

MD5: 94880054fae8150736ddd0940cf3d052

SHA1: 1cef9367490f6dbae44e0c06a30ed6901eb51f72

SHA256: 64FF17EA1B755078EB71910CA6705327724CAD87D6B83528487EAE4A0EE48AD7

File Size: 570.53 KB, 570527 bytes

MD5: b55ba4ab6d14a0a6970a4c1b7e41ea3c

SHA1: 6b2423dd680c30db43cec317d23318d1f6208f0d

SHA256: 006AF2C668ABADBEE3F5E09494B05070FE63E3C9A66141B494FF053F4213346C

File Size: 7.45 MB, 7453400 bytes

MD5: 987fdf7e056940e7c168a8b36ca92a7b

SHA1: 5093cf5854a2bcdc5900073c8846c617e782411a

SHA256: 4DFE0CABC8E90401CB0E1A12054C6F630230B4DA43052551C1E360BA8BB65A23

File Size: 213.14 KB, 213144 bytes

MD5: f0b68b4fe175f02fa094f7dfad99bc06

SHA1: 153d3fe4e46b8c54323b07902dea4863e80d6d08

SHA256: F2EED5CF684E6D33D15F1DD1402C4EA885F85EAE5C10AEE0A31364BB7C22EE62

File Size: 7.46 MB, 7455960 bytes

MD5: 35ffcd64dad49bbb380379553421efa8

SHA1: ca556d3306fcf6e782dd457944a4437c66c8ab05

SHA256: 7B4FDA9BC9415E3859E6FFDC49F280AB21CEFD7158F2DD405375B6D8BE4EB790

File Size: 3.66 MB, 3662101 bytes

MD5: 9aaf163322a412c654f94808bf8b06d2

SHA1: cefe8c75414743a7073c0001f207e5b9a089df2d

SHA256: 46F27DFEB41681BED5B9568D0126B33AA7EFC571DA0A84772B52D1F670CF9324

File Size: 749.67 KB, 749671 bytes

MD5: a8579d02d10fe0905d1374f357a12edd

SHA1: 09935471031fffdde3cc65c21f007c948478c7f2

SHA256: 3AF4D6B4CD79830AD8A5746A197A3A1D4EC04C997FA296D0F4286E83FA248A54

File Size: 1.51 MB, 1511192 bytes

MD5: d4885f1cd65dc17870c2043b63659d4b

SHA1: 2613ca41844a1ff87ffe7711638a5a0ce5c2d4cb

SHA256: 5E18D9FFD9F0CB39AEA3024BB24B0C3BB28F4AED1E9C03CDA63BD3296407B766

File Size: 1.51 MB, 1511512 bytes

MD5: 8916651bc99b4b64edf735fdda2fc0f7

SHA1: c668632d4b3db8b957ed7b9785655728fe4f2556

SHA256: 4C3D5F864D0EBFAFA74EA0B68D22B93EF40D26F9224246BB239286C16DB3B8AE

File Size: 7.47 MB, 7473368 bytes

MD5: d826ca74a2d83a6e5909da48a642ff3b

SHA1: 888b1901daa4505a181ebdc6a03258ea46caea3d

SHA256: 5A63B628AA400BDB116A955CCA8B8126FAB9E7C016AEA35D7700556DA7607EB8

File Size: 1.80 MB, 1798773 bytes

MD5: a061a4a8dac4df34fb139637394fa0db

SHA1: 84dca533e1f27a6a52e9ca026866a5217f44c2f4

SHA256: 462BEED5FED8BF1783394C23AB2C737137043C061A25516361C2A0D351E016CF

File Size: 7.47 MB, 7473368 bytes

MD5: 9ea227083f4efd382476cc47ca8b21da

SHA1: 65da92a868db84d9daa240bc4e1bd30e19a6ad84

SHA256: BAEFD3EDCD88177C4B9A2FB77302B6CFE7F7B358AF5B50E6834C627C663F3587

File Size: 1.51 MB, 1511512 bytes

MD5: aa1f82f17c95a0fb0d29409e0f98a4e1

SHA1: 845f282b4669406a4ebf4bd498330c3f0cd66637

SHA256: 36043E09D52C69D284B250462240CEF8CB4FCAA3216F2A487AAEBDB03F34CFDD

File Size: 586.62 KB, 586618 bytes

MD5: ded444e1379d5b4a35305331827e6076

SHA1: ebc37690536b83a7819a880d5e01b758a2ca0427

SHA256: 707113CB1CD9C7949FE52D228E9C8211694E5514D9D307CC32D452531E5A70B9

File Size: 447.65 KB, 447648 bytes

MD5: 880a1ee8639252aab3d242575f35ed17

SHA1: 749373219fa737d14d4fb88d68c4266fae1d7af0

SHA256: D06D38C53A5BD59B4465E395148D7D4C6DB5EC730AB9B06D7C1BD08C80CE0FAC

File Size: 2.22 MB, 2219512 bytes

MD5: fd6ab938068fded9e440247a468a0749

SHA1: e0ee46581f96159818df3b74804908022c6a728f

SHA256: 6694C714282DF6AC0E10DFD43BA60CF30D4455C06A20BFCEFBB279E02EFB3EBD

File Size: 7.09 MB, 7089368 bytes

MD5: 44913bbb3c569bd8622a520d11404485

SHA1: 7c6d684860ddfd4f322ec9c8b0d469b92a79d118

SHA256: 4283A32BCB48B7FFB1A9DB4FD346FF31CF3225EABDBE28392BCEB4CCC76A1CAE

File Size: 1.55 MB, 1545680 bytes

MD5: 5da687d53c39c4903ad4f9dee54351b8

SHA1: ae19893ae1f8af1a0aeb37b59413cfda93968f9e

SHA256: EEBAD2C3F1F871BA2E0D8B18B522A83AA59FF8D0555911F3BD73D4880E69DFBA

File Size: 7.09 MB, 7092952 bytes

MD5: 1a5aa9e51f35f25a8dfbd1ebd8d70efc

SHA1: 23353151c8d14f21849cc89676df19d155a2de5c

SHA256: 6A881AAF1DFB83CD9582F8149447936FDBE5A113064CB2DA4897C9FCB15BEB4E

File Size: 1.08 MB, 1084120 bytes

MD5: f8e1bb2dc2b5de01a8b38e277c07a068

SHA1: aed692f51d2e0ae3e862ee027c63990d80ff7b3e

SHA256: E99D6A42602F47C06E3134D7AFBFA4EA1738061C4A164E3D83A19A05EEED2985

File Size: 7.15 MB, 7146712 bytes

MD5: 79697ee534d438160d118ad27c3a9a1f

SHA1: 21cd827faf119fd7356c4485bd1e43a869aa3c70

SHA256: 8CAF9FFEC157C0A193E3CA5FC7B0918573D101872D062D422D5E83EA94AD78D9

File Size: 124.58 KB, 124576 bytes

MD5: 5154b74d4115f03b7cb48b1c51cfc3ac

SHA1: dc2ed4dda084b95dfb2d07dc3b48311819b73883

SHA256: 3BD2438E9738B18AC6DC179C4169260AF2249A3F33E435CFCC201D400EC1C05A

File Size: 1.08 MB, 1083168 bytes

MD5: f63e1e22830b85d6ae9fc84b1c8e6524

SHA1: 50094930e739ec402b1fdac12bcae06da368f3d0

SHA256: D778AAEFC0A6E0E66C59C468FE593E1A1D08E68F389A55E507936279C29D4EB9

File Size: 7.15 MB, 7146712 bytes

MD5: 3039df8ff9c2134b1f58f2f5f77d534d

SHA1: 12908c6b7324ef5a9f3a29515003e157d7e991b8

SHA256: C51E3F0FF19B28CE286F7F86D59B16F39A3CB3B27C97B149D9733A4FFD7550A6

File Size: 1.55 MB, 1545680 bytes

MD5: 5f2a688e91b0f3a07f532818b2887f7e

SHA1: 830d5310658f774039a1b9cb4e24b7bc7001e9c1

SHA256: EF82264C3DFDDCE53FAE449D77DC15E07E75741F93AC18B0FAA62628A0C9166E

File Size: 7.86 MB, 7858688 bytes

Windows Portable Executable Attributes

File doesn't have "Rich" header
File doesn't have debug information
File doesn't have exports table
File doesn't have relocations information
File doesn't have security information
File has exports table
File has TLS information
File is 32-bit executable
File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
File is either console or GUI application

File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
File is Native application (NOT .NET application)
File is not packed
IMAGE_FILE_DLL is not set inside PE header (Executable)
IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name	Value
Comments	This installation was built with Inno Setup. TurboVPN
Company Name	Innovative Connecting INNOVATIVE CONNECTING PTE. LIMITED Microsoft Corporation nnovative Connecting VPN
File Description	breakpad master_vpn-service Setup/Uninstall Startup TurboVPN TurboVPN install package turbo_vpn-service Windows Image Helper winuet
File Version	51.1052.0.0 6.11.0001.404 (debuggers(dbg).090225-1745) 3.99.0.0 3.7.1.0 3.7.0.0 3.5.1.0 3.5.0.0 3.4.2.0 3.4.1.0 3.3.0.0 Show More 3.2.0.0 3.1.1.0 2.22.0.0 2.11.0.0 1.0.0.1
Internal Name	breakpad.dll DBGHELP.DLL master_vpn-service.exe Startup.exe TurboVPN.exe TurboVpn.exe turbo_vpn-service.exe winuet.dll
Legal Copyright	Copyright (C) 2020 Copyright(C) 2020 inconnecting Copyright (C) 2024 Copyright(C) 2025 inconnecting © Microsoft Corporation. All rights reserved.
Legal Trademarks	inconnecting.com
Original Filename	breakpad.dll DBGHELP.DLL master_vpn-service.exe Startup.exe TurboVPN.exe turbo_vpn-service.exe winuet.dll
Product Name	breakpad.ll Debugging Tools for Windows(R) master_vpn-service Startup TurboVPN TurboVPN turbo_vpn-service winuet
Product Version	6.11.0001.404 3.99.0.0 3.7.1.0 3.7.0.0 3.5.1.0 3.5.0.0 3.4.2.0 3.4.1.0 3.3.0.0 3.2.0.0 Show More 3.1.1.0 2.22.0.0 2.11.0.0 2.0 1.0.0.1

Digital Signatures

Signer	Root	Status
INNOVATIVE CONNECTING PTE. LIMITED	DigiCert Trusted Root G4	Root Not Trusted
INNOVATIVE CONNECTING PTE. LIMITED	DigiCert Trusted Root G4	Hash Mismatch
INNOVATIVE CONNECTING PTE. LIMITED	Symantec Class 3 Extended Validation Code Signing CA - G2	Hash Mismatch
INNOVATIVE CONNECTING PTE. LIMITED	VeriSign Class 3 Public Primary Certification Authority - G5	Root Not Trusted

File Traits

2+ executable sections
HighEntropy
Inno
InnoSetup Installer
Installer Manifest
Installer Version
nosig nsis
Nullsoft Installer
VirtualQueryEx
x86

Block Information

Total Blocks:	8,513
Potentially Malicious Blocks:	54
Whitelisted Blocks:	6,705
Unknown Blocks:	1,754

Visual Map

x 0 ? ? 0 ? 0 ? ? ? 0 ? 0 ? ? 0 ? 0 ? 0 0 0 ? 0 ? 0 ? ? 0 ? ? 0 ? ? 0 x ? ? 0 0 x ? 0 ? 0 ? ? ? 0 x ? ? 0 0 ? 0 ? ? 0 ? ? 0 x ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 ? 0 ? 0 ? 0 ? 0 ? ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? ? 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? ? 0 ? 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 ? 0 0 0 ? 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? ? ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 ? ? 0 0 0 0 0 ? 0 ? 0 0 0 0 ? 0 ? 0 ? 0 x ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 1 ? x x x x x 0 0 0 ? ? ? ? 0 0 0 0 0 ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 ? ? ? 0 ? 0 ? 0 0 ? ? ? 0 ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? x 0 0 0 x 0 0 ? 0 0 0 ? ? ? ? ? 0 0 0 ? 0 ? ? ? 0 0 0 0 0 0 ? ? ? ? x 0 ? ? ? ? ? ? 0 0 ? 0 0 0 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 0 0 ? ? 0 ? ? 0 0 ? ? ? 0 0 ? ? ? ? ? ? 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 ? 0 0 ? ? 0 ? 0 0 0 0 ? x 0 0 0 x 0 0 ? 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 x 0 ? ? x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 ? 0 0 0 0 ? 0 ? 0 ? 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 ? ? 0 0 0 ? 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? ? 0 ? ? ? 0 0 0 ? ? ? ? ? 0 ? 0 0 ? ? ? ? 0 ? 0 ? ? ? ? ? 0 ? ? ? ? 0 0 ? 0 ? 0 ? ? 0 0 0 0 0 0 0 0 1 0 ? 0 0 0 ? ? ? 0 ? ? 0 0 0 0 ? ? ? ? ? 0 ? 0 ? 0 0 ? 0 0 ? ? ? ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 ? 0 0 ? 0 0 ? 0 0 0 ? 0 ? 0 ? 0 0 ? ? ? 0 0 0 ? 0 ? ? 0 ? 0 0 ? ? 0 0 0 0 0 0 ? ? ? 0 0 ? ? ? 0 0 ? ? ? 0 ? x x 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? 0 ? ? 0 0 0 ? 0 0 ? x ? 0 x 0 0 ? ? ? 0 0 0 0 0 ? 0 0 0 ? 0 ? 0 ? 0 ? ? 0 0 ? 0 0 0 0 ? 0 0 ? 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? ? ? ? 0 ? 0 ? ? 0 0 ? 0 0 ? 0 ? 0 0 0 0 ? ? ? ? ? 0 0 ? 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 0 0 0 0 ? 0 0 0 0 x ? ? ? ? ? 0 ? ? ? 0 ? ? 0 0 0 0 ? ? 0 0 ? ? ? 0 ? 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? ? ? ? 0 0 ? ? ? 0 ? 0 ? ? 0 0 ? ? ? ? ? 0 ? ? ? 1 ? ? ? ? 0 0 0 ? ? ? ? ? 0 0 ? ? ? ? ? ? ? 0 0 ? 0 ? ? 0 0 0 ? ? ? ? ? ? 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 ? 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 ? 0 0 ? 0 ? ? 0 0 ? ? ? ? 0 0 ? ? 0 0 0 0 ? 0 0 0 ? 0 0 ? 0 ? 0 ? ? 0 0 ? ? ? 0 ? 0 0 ? ? ? ? ? ? 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 ? 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 ? ? 0 0 0 0 x ? ? ? 0 ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 x 0 0 0 0 0 ? 0 ? 0 0 ? ? 0 ? 0 0 ? 0 ? ? ? ? 0 0 ? ? ? ? 0 0 ? ? ? ? 0 0 0 0 ? ? 0

... Data truncated

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

Injector.AK
Lumma.GFD
Rugmi.IA
Sheloader.A
Stealer.KF

Files Modified

File	Attributes
c:\users\user\appdata\local\temp\nsf84d.tmp\nsniuniuskin.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsf84d.tmp\skin.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsg6442.tmp\nsniuniuskin.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsg6442.tmp\skin.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsi7b98.tmp\nsniuniuskin.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsi7b98.tmp\skin.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nso43b8.tmp\logo.ico	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nso43b8.tmp\nsniuniuskin.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nso43b8.tmp\skin.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nso43b8.tmp\system.dll	Generic Write,Read Attributes

c:\users\user\appdata\local\temp\nso507e.tmp\nsniuniuskin.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nso507e.tmp\skin.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu8b38.tmp\logo.ico	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu8b38.tmp\nsniuniuskin.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu8b38.tmp\skin.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu8b38.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\turbovpnuninst.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\temp\~nsu.tmp\au_.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\local\temp\~nsua.tmp\un_a.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144

Registry Modifications

Key::Value	Data	API Name
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Hpldutbx\AppData\Local\Temp\~nsu.tmp\Au_.exe	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Hpldutbx\AppData\Local\Temp\~nsu.tmp\Au_.exe\??\C:\Users\Hpldutbx\AppData\Local\Temp\~nsu.tmp	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\??\C:\Windows\SystemTemp\b1a39cca-eadf-4949-a384-a0ef6a3b3fd2.tmp\	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e41\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352*1\??\C:\P	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af521\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62*1\??\C:\P	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�k9 �v�ZT��Bx#�#��(�(X�1`1�1HO@V�H[uH�pN$U5�_�z`b.k`k�ql(�o�o�ww�mw�n{b��P��jI��!��3��~��T��.��*�m�Ù��gi�V��$�8�fწ��l��΄�&M�@�	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey

HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	� * �/��Y�d�� ރ�p ��^�o�ee-Vs}kP~��1��7 ��ﺃee��1��fe��i/e��rS�v	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m��jg �� v xy ��T��%��Bx�<#�#��&� (�(X�(�)�`J9�",��-!R1�1HO1�D5,]9ߔ@V�A��G�IH[uH�pJ��N$N�R20U_X�.X�_�z`�2b"hc�wc�zh�ri��j�bk`k�ql(�lR o�q�X	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n& �v��Bx#��(�1`1�1HO@V�A��H[uN$_�zb"hk`k�q{b��P��!��3��m�Ù��gi�V��$�8წ��l��&MA�~��=�SB1_B��T�Vw�`�V��%��AE��D��&��$��	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n& �v��Bx#��(�1`1�1HO@V�A��H[uN$_�zb"hk`k�q{b��P��!��3��m�Ù��gi�V��$�8წ��l��&MA�~��=�SB1_B��T�Vw�`�V�R��%��AE��D��&��$��	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::left	ঔ	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::top		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n( �v��Bx#��%�(�1`1�1HO@V�A��H[uN$_�za$b"hk`k�q{b��P��!��3��m�Ù��gi�V��$�8წ��l��&MA�~��=�SB1_B��T�Vw�`�V�R��i��%��AE��	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n) �v��Bx#��%�(�1`1�1HO@V�A��H[uN$_�za$b"he�vk`k�q{b��P��!��3��m�Ù��gi�V��$�8წ��l��&MA�~��=�SB1_B��T�Vw�`�V�R��i��%��A	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n* �v��Bx#��%�(�1`1�1HO@V�A��H[uN$_�za$b"he�vk`k�qw�n{b��P��!��3��m�Ù��gi�V��$�8წ��l��&MA�~��=�SB1_B��T�Vw�`�V�R��i��%��	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n+ �v��Bx#��%�(�1`1�1HO@V�A��H[uN$_�za$b"he�vk`k�qw�n{b��P��!��3��m�Ù��gi�V��$�8წ��l��&MA�~��=�SB1_B��T�Vw�`�V�R��i��%��	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	鴲ȁ獖}	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n. �v��Bx#��%�(�,=�1`1�1HO@V�A��H[uN$N�_�za$b"he�vk`k�qw�ny�9{b��P��!��3��m�Ù��gi�V��$�8წ��l��&MA�~��=�SB1_B��T�Vw�`�V�R��i	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n3 �v��Bx#��%�(�,=�1`1�1HO@V�A��H[uN$N�_�za$b"he�vk`k�qw�ny�9{b��P��!��7��3��j��m�Ù��IV�gi�V��$�>��8წ��l��&M�^A�~��=�SB1_B�	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n4 �v ��Bx#��%�(�,=�1`1�1HO@V�A��H[uN$N�_�za$b"he�vk`k�qw�ny�9{b��P��!��7��3��j��m�Ù��IV�gi�V��$�>��8წ��l��&M�^A�~��=�SB1	RegNtPreCreateKey

Windows API Usage

Category	API
Process Shell Execute	CreateProcess
Anti Debug	IsDebuggerPresent NtQuerySystemInformation OutputDebugString
Keyboard Access	GetKeyState
User Data Access	GetUserObjectInformation
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtProtectVirtualMemory Show More ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWriteFile ntdll.dll!NtWriteVirtualMemory win32u.dll!NtUserGetKeyboardLayout win32u.dll!NtUserGetThreadState
Process Manipulation Evasion	NtUnmapViewOfSection

Shell Command Execution


							"C:\Users\Hpldutbx\AppData\Local\Temp\~nsu.tmp\Au_.exe"  _?=c:\users\user\downloads\


							C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5093cf5854a2bcdc5900073c8846c617e782411a_0000213144.,LiQMAxHB


							"C:\Users\Sgbyajgo\AppData\Local\Temp\~nsu.tmp\Au_.exe"  _?=c:\users\user\downloads\


							"C:\Users\Zzxtmdvk\AppData\Local\Temp\~nsu.tmp\Au_.exe"  _?=c:\users\user\downloads\


							"C:\Users\Mjcjmvol\AppData\Local\Temp\~nsu.tmp\Au_.exe"  _?=c:\users\user\downloads\


									"C:\Users\Uifgtmke\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"  _?=c:\users\user\downloads\


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ebc37690536b83a7819a880d5e01b758a2ca0427_0000447648.,LiQMAxHB


									"C:\Users\Xoehqgcu\AppData\Local\Temp\~nsu.tmp\Au_.exe"  _?=c:\users\user\downloads\


									"C:\Users\Xoehqgcu\AppData\Local\Temp\TurboVPNUninst.exe" _?=c:\users\user\downloads


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\21cd827faf119fd7356c4485bd1e43a869aa3c70_0000124576.,LiQMAxHB


									C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\dc2ed4dda084b95dfb2d07dc3b48311819b73883_0001083168.,LiQMAxHB


									"C:\Users\Tkigtfyt\AppData\Local\Temp\~nsu.tmp\Au_.exe"  _?=c:\users\user\downloads\


									"C:\Users\Tkigtfyt\AppData\Local\Temp\TurboVPNUninst.exe" _?=c:\users\user\downloads

PUP.Turbo VPN

Threat Scorecard

EnigmaSoft Threat Scorecard

What Is PUP.Turbo VPN?

How PUP.Turbo VPN Operates

Symptoms of Infection

How to Remove PUP.Turbo VPN

Conclusion

SpyHunter Detects & Remove PUP.Turbo VPN

File System Details

Registry Details

Directories

Analysis Report

General information

Known Samples

Known Samples

Windows Portable Executable Attributes

Windows Portable Executable Attributes

File Icons

File Icons

Windows PE Version Information

Windows PE Version Information

Digital Signatures

Digital Signatures

File Traits

Block Information

Block Information

Visual Map

Similar Families

Similar Families

Files Modified

Files Modified

Registry Modifications

Registry Modifications

Windows API Usage

Windows API Usage

Shell Command Execution

Shell Command Execution

Submit Comment

Related Posts

Trending

Most Viewed