gh0strat | 55f23b3a54b6b43338997ad5554f046e205042fd00a81a8e04f9bd6a8dcc8c07

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2022 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f5a8b7ca30c757f4cfcbd338d79dd06ebb6db62451845d7b53f38c54ad7da7a.msi
Size

13.7MB
MD5

afb73daab97a1a8fb156ed34715a01ca
SHA1

ecb0ea164d1d1ceea4a0fb0d06f61345f4a65ac3
SHA256

4f5a8b7ca30c757f4cfcbd338d79dd06ebb6db62451845d7b53f38c54ad7da7a
SHA512

35dec58a6525f91f6edb2cd9ef3e53f76cbee700ac7e489cda85a443835d210cbef4d369eb3084cb4ad8f5a06a281ea35908249ff6a4f566623c99d7c94487e9
SSDEEP

393216:w3Bp4yJDyaxkvEIeg/sczcezXEbpFS+zYeOPuet:WBy0Gax2fbDlzEbpFfzYeO

Score

10^/10

gh0strat purplefox discovery evasion persistence rat rootkit trojan vmprotect

Malware Config

Signatures

Detect PurpleFox Rootkit 3 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/4876-179-0x0000000000400000-0x00000000006A8000-memory.dmp	purplefox_rootkit
behavioral2/memory/4876-180-0x0000000010000000-0x0000000010192000-memory.dmp	purplefox_rootkit
behavioral2/memory/4876-207-0x0000000000400000-0x00000000006A8000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4876-179-0x0000000000400000-0x00000000006A8000-memory.dmp	family_gh0strat
behavioral2/memory/4876-180-0x0000000010000000-0x0000000010192000-memory.dmp	family_gh0strat
behavioral2/memory/4876-207-0x0000000000400000-0x00000000006A8000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

Processes:

DrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET7F71.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET7F71.tmp	DrvInst.exe

Executes dropped EXE 10 IoCs

Processes:

MSIE313.tmpkk.exeletsvpn.exeact.exelsp.exetapinstall.exetapinstall.exetapinstall.exeLetsPRO.exeLetsPRO.exe

pid	process
3988	MSIE313.tmp
3784	kk.exe
3968	letsvpn.exe
4604	act.exe
4876	lsp.exe
1504	tapinstall.exe
4612	tapinstall.exe
2088	tapinstall.exe
5100	LetsPRO.exe
2468	LetsPRO.exe

Modifies Windows Firewall 1 TTPs 4 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

pid process

3500 netsh.exe
388 netsh.exe
2744 netsh.exe
2936 netsh.exe

pid	process
3500	netsh.exe
388	netsh.exe
2744	netsh.exe
2936	netsh.exe

VMProtect packed file 19 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Windows\Installer\MSIE313.tmp	vmprotect
C:\Windows\Installer\MSIE313.tmp	vmprotect
behavioral2/memory/3988-136-0x0000000000400000-0x0000000001DFA000-memory.dmp	vmprotect
behavioral2/memory/3988-137-0x0000000000400000-0x0000000001DFA000-memory.dmp	vmprotect
C:\Users\Admin\AppData\Local\Temp\kk.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\kk.exe	vmprotect
behavioral2/memory/3784-142-0x0000000000400000-0x0000000000437000-memory.dmp	vmprotect
behavioral2/memory/3784-144-0x0000000000400000-0x0000000000437000-memory.dmp	vmprotect
C:\Users\Public\Pictures\23999\act.exe	vmprotect
behavioral2/memory/4604-151-0x00007FF71EF10000-0x00007FF71EF90000-memory.dmp	vmprotect
C:\Users\Public\Pictures\23999\act.exe	vmprotect
behavioral2/memory/4604-153-0x00007FF71EF10000-0x00007FF71EF90000-memory.dmp	vmprotect
behavioral2/memory/3988-156-0x0000000000400000-0x0000000001DFA000-memory.dmp	vmprotect
C:\Users\Public\Videos\lsp.exe	vmprotect
C:\Users\Public\Videos\lsp.exe	vmprotect
behavioral2/memory/4876-177-0x0000000000400000-0x00000000006A8000-memory.dmp	vmprotect
behavioral2/memory/4876-179-0x0000000000400000-0x00000000006A8000-memory.dmp	vmprotect
behavioral2/memory/4604-193-0x00007FF71EF10000-0x00007FF71EF90000-memory.dmp	vmprotect
behavioral2/memory/4876-207-0x0000000000400000-0x00000000006A8000-memory.dmp	vmprotect

Loads dropped DLL 56 IoCs

Processes:

letsvpn.exeLetsPRO.exe

pid	process
3968	letsvpn.exe
3968	letsvpn.exe
3968	letsvpn.exe
3968	letsvpn.exe
3968	letsvpn.exe
3968	letsvpn.exe
3968	letsvpn.exe
3968	letsvpn.exe
3968	letsvpn.exe
3968	letsvpn.exe
3968	letsvpn.exe
3968	letsvpn.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

LetsPRO.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LetsPRO = "\"C:\\Program Files (x86)\\letsvpn\\app-3.2.8\\LetsPRO.exe\" /silent"	LetsPRO.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 16 IoCs

Processes:

DrvInst.exetapinstall.exe

description	ioc	process
File created	C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\SET4B33.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\SET4AF3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\SET4B33.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\SET4B43.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\oemvista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\oemvista.PNF	tapinstall.exe
File created	C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\SET4AF3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\tap0901.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\SET4B43.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_a572b7f20c402d28\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}	DrvInst.exe

Drops file in Program Files directory 64 IoCs

Processes:

letsvpn.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\runtimes\win-arm\native	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.ComponentModel.TypeConverter.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Runtime.Serialization.Formatters.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Security.Cryptography.Encoding.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Security.Cryptography.X509Certificates.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\netstandard.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\Hardcodet.Wpf.TaskbarNotification.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.Web.WebView2.Core.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.Web.WebView2.WinForms.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\SQLiteNetExtensions.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Diagnostics.Process.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Diagnostics.Tools.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Dynamic.Runtime.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.IO.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\zh-TW\LetsPRO.resources.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Reflection.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Text.Encoding.Extensions.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\runtimes\win-x64\native\e_sqlite3.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Linq.Parallel.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.NetworkInformation.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.WebHeaderCollection.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Numerics.Vectors.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Text.RegularExpressions.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Data.Common.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.NameResolution.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Runtime.Serialization.Json.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\ToastNotifications.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\runtimes\win-x64\native	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.IO.UnmanagedMemoryStream.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.Security.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Security.Cryptography.X509Certificates.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Xml.XPath.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Xml.XmlDocument.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\microsoft.identitymodel.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\View\Assets\notification_icon.png	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\MdXaml.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\SQLite-net.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Runtime.InteropServices.RuntimeInformation.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Runtime.InteropServices.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Security.Cryptography.Csp.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\runtimes\win-arm\native\e_sqlite3.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Diagnostics.StackTrace.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.Sockets.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.ObjectModel.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Resources.Reader.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\runtimes\win-arm	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Security.Cryptography.Csp.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\Mono.Cecil.Mdb.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Collections.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Linq.Expressions.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Linq.Queryable.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.IPNetwork.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\LetsPRO.exe	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.Crashes.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Resources.ResourceManager.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Resources.Writer.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Runtime.Serialization.Primitives.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Management.Automation.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Net.Http.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\System.Threading.dll	letsvpn.exe
File created	C:\Program Files (x86)\letsvpn\app-3.2.8\System.ValueTuple.dll	letsvpn.exe
File opened for modification	C:\Program Files (x86)\letsvpn\app-3.2.8\zh-SG\LetsPRO.resources.dll	letsvpn.exe

Drops file in Windows directory 14 IoCs

Processes:

msiexec.exetapinstall.exeDrvInst.exeDrvInst.exesvchost.exe

description	ioc	process
File created	C:\Windows\Installer\e56e10e.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE275.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e56e10e.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE313.tmp	msiexec.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D0D5A8D4-2C54-41FD-A0C3-50CC56973D60}	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1256 4876 WerFault.exe lsp.exe

pid	pid_target	process	target process
1256	4876	WerFault.exe	lsp.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DrvInst.exevssvc.exetapinstall.exesvchost.exeDrvInst.exetapinstall.exetapinstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000789d96067ff55f5b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000789d96060000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff000000000700010000680900789d9606000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000789d960600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LetsPRO.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LetsPRO.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LetsPRO.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

SCHTASKS.exe

pid process

2980 SCHTASKS.exe
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

3580 ipconfig.exe

pid	process
2980	SCHTASKS.exe

pid	process
3580	ipconfig.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe

Modifies registry class 9 IoCs

Processes:

LetsPRO.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command\ = "\"C:\\Program Files (x86)\\letsvpn\\app-3.2.8\\LetsPRO.exe\" \"%1\""	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\URL Protocol = "C:\\Program Files (x86)\\letsvpn\\app-3.2.8\\LetsPRO.exe"	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon\ = "\"C:\\Program Files (x86)\\letsvpn\\app-3.2.8\\LetsPRO.exe\",1"	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\ = "letsvpn2Protocol"	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell	LetsPRO.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

rundll32.exeLetsPRO.exetapinstall.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	rundll32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	LetsPRO.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	LetsPRO.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	tapinstall.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exekk.exeact.exe

pid	process
1408	msiexec.exe
1408	msiexec.exe
3784	kk.exe
3784	kk.exe
3784	kk.exe
3784	kk.exe
3784	kk.exe
3784	kk.exe
3784	kk.exe
3784	kk.exe
3784	kk.exe
3784	kk.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe
4604	act.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exepowershell.exesvchost.exetapinstall.exeDrvInst.exe

description	pid	process
Token: SeShutdownPrivilege	2112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2112	msiexec.exe
Token: SeSecurityPrivilege	1408	msiexec.exe
Token: SeCreateTokenPrivilege	2112	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2112	msiexec.exe
Token: SeLockMemoryPrivilege	2112	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2112	msiexec.exe
Token: SeMachineAccountPrivilege	2112	msiexec.exe
Token: SeTcbPrivilege	2112	msiexec.exe
Token: SeSecurityPrivilege	2112	msiexec.exe
Token: SeTakeOwnershipPrivilege	2112	msiexec.exe
Token: SeLoadDriverPrivilege	2112	msiexec.exe
Token: SeSystemProfilePrivilege	2112	msiexec.exe
Token: SeSystemtimePrivilege	2112	msiexec.exe
Token: SeProfSingleProcessPrivilege	2112	msiexec.exe
Token: SeIncBasePriorityPrivilege	2112	msiexec.exe
Token: SeCreatePagefilePrivilege	2112	msiexec.exe
Token: SeCreatePermanentPrivilege	2112	msiexec.exe
Token: SeBackupPrivilege	2112	msiexec.exe
Token: SeRestorePrivilege	2112	msiexec.exe
Token: SeShutdownPrivilege	2112	msiexec.exe
Token: SeDebugPrivilege	2112	msiexec.exe
Token: SeAuditPrivilege	2112	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2112	msiexec.exe
Token: SeChangeNotifyPrivilege	2112	msiexec.exe
Token: SeRemoteShutdownPrivilege	2112	msiexec.exe
Token: SeUndockPrivilege	2112	msiexec.exe
Token: SeSyncAgentPrivilege	2112	msiexec.exe
Token: SeEnableDelegationPrivilege	2112	msiexec.exe
Token: SeManageVolumePrivilege	2112	msiexec.exe
Token: SeImpersonatePrivilege	2112	msiexec.exe
Token: SeCreateGlobalPrivilege	2112	msiexec.exe
Token: SeBackupPrivilege	1884	vssvc.exe
Token: SeRestorePrivilege	1884	vssvc.exe
Token: SeAuditPrivilege	1884	vssvc.exe
Token: SeBackupPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeRestorePrivilege	1408	msiexec.exe
Token: SeTakeOwnershipPrivilege	1408	msiexec.exe
Token: SeBackupPrivilege	1596	srtasks.exe
Token: SeRestorePrivilege	1596	srtasks.exe
Token: SeSecurityPrivilege	1596	srtasks.exe
Token: SeTakeOwnershipPrivilege	1596	srtasks.exe
Token: SeBackupPrivilege	1596	srtasks.exe
Token: SeRestorePrivilege	1596	srtasks.exe
Token: SeSecurityPrivilege	1596	srtasks.exe
Token: SeTakeOwnershipPrivilege	1596	srtasks.exe
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeAuditPrivilege	1188	svchost.exe
Token: SeSecurityPrivilege	1188	svchost.exe
Token: SeLoadDriverPrivilege	4612	tapinstall.exe
Token: SeRestorePrivilege	736	DrvInst.exe
Token: SeBackupPrivilege	736	DrvInst.exe
Token: SeLoadDriverPrivilege	736	DrvInst.exe
Token: SeLoadDriverPrivilege	736	DrvInst.exe
Token: SeLoadDriverPrivilege	736	DrvInst.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

msiexec.exeLetsPRO.exe

pid process

2112 msiexec.exe
2112 msiexec.exe
2468 LetsPRO.exe
2468 LetsPRO.exe
2468 LetsPRO.exe
2468 LetsPRO.exe
2468 LetsPRO.exe
Suspicious use of SendNotifyMessage 5 IoCs

Processes:

LetsPRO.exe

pid process

2468 LetsPRO.exe
2468 LetsPRO.exe
2468 LetsPRO.exe
2468 LetsPRO.exe
2468 LetsPRO.exe

pid	process
2112	msiexec.exe
2112	msiexec.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe

pid	process
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe
2468	LetsPRO.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exeMSIE313.tmpkk.exeletsvpn.exesvchost.exeDrvInst.execmd.execmd.execmd.execmd.exeLetsPRO.exe

description	pid	process	target process
PID 1408 wrote to memory of 1596	1408	msiexec.exe	srtasks.exe
PID 1408 wrote to memory of 1596	1408	msiexec.exe	srtasks.exe
PID 1408 wrote to memory of 3988	1408	msiexec.exe	MSIE313.tmp
PID 1408 wrote to memory of 3988	1408	msiexec.exe	MSIE313.tmp
PID 1408 wrote to memory of 3988	1408	msiexec.exe	MSIE313.tmp
PID 3988 wrote to memory of 3784	3988	MSIE313.tmp	kk.exe
PID 3988 wrote to memory of 3784	3988	MSIE313.tmp	kk.exe
PID 3988 wrote to memory of 3784	3988	MSIE313.tmp	kk.exe
PID 3988 wrote to memory of 3968	3988	MSIE313.tmp	letsvpn.exe
PID 3988 wrote to memory of 3968	3988	MSIE313.tmp	letsvpn.exe
PID 3988 wrote to memory of 3968	3988	MSIE313.tmp	letsvpn.exe
PID 3784 wrote to memory of 4604	3784	kk.exe	act.exe
PID 3784 wrote to memory of 4604	3784	kk.exe	act.exe
PID 3968 wrote to memory of 2344	3968	letsvpn.exe	powershell.exe
PID 3968 wrote to memory of 2344	3968	letsvpn.exe	powershell.exe
PID 3968 wrote to memory of 2344	3968	letsvpn.exe	powershell.exe
PID 3784 wrote to memory of 4876	3784	kk.exe	lsp.exe
PID 3784 wrote to memory of 4876	3784	kk.exe	lsp.exe
PID 3784 wrote to memory of 4876	3784	kk.exe	lsp.exe
PID 3784 wrote to memory of 2980	3784	kk.exe	SCHTASKS.exe
PID 3784 wrote to memory of 2980	3784	kk.exe	SCHTASKS.exe
PID 3784 wrote to memory of 2980	3784	kk.exe	SCHTASKS.exe
PID 3968 wrote to memory of 1504	3968	letsvpn.exe	tapinstall.exe
PID 3968 wrote to memory of 1504	3968	letsvpn.exe	tapinstall.exe
PID 3968 wrote to memory of 4612	3968	letsvpn.exe	tapinstall.exe
PID 3968 wrote to memory of 4612	3968	letsvpn.exe	tapinstall.exe
PID 1188 wrote to memory of 1976	1188	svchost.exe	DrvInst.exe
PID 1188 wrote to memory of 1976	1188	svchost.exe	DrvInst.exe
PID 1976 wrote to memory of 3628	1976	DrvInst.exe	rundll32.exe
PID 1976 wrote to memory of 3628	1976	DrvInst.exe	rundll32.exe
PID 1188 wrote to memory of 736	1188	svchost.exe	DrvInst.exe
PID 1188 wrote to memory of 736	1188	svchost.exe	DrvInst.exe
PID 3968 wrote to memory of 1412	3968	letsvpn.exe	cmd.exe
PID 3968 wrote to memory of 1412	3968	letsvpn.exe	cmd.exe
PID 3968 wrote to memory of 1412	3968	letsvpn.exe	cmd.exe
PID 1412 wrote to memory of 3500	1412	cmd.exe	netsh.exe
PID 1412 wrote to memory of 3500	1412	cmd.exe	netsh.exe
PID 1412 wrote to memory of 3500	1412	cmd.exe	netsh.exe
PID 3968 wrote to memory of 1844	3968	letsvpn.exe	cmd.exe
PID 3968 wrote to memory of 1844	3968	letsvpn.exe	cmd.exe
PID 3968 wrote to memory of 1844	3968	letsvpn.exe	cmd.exe
PID 1844 wrote to memory of 388	1844	cmd.exe	netsh.exe
PID 1844 wrote to memory of 388	1844	cmd.exe	netsh.exe
PID 1844 wrote to memory of 388	1844	cmd.exe	netsh.exe
PID 3968 wrote to memory of 1804	3968	letsvpn.exe	cmd.exe
PID 3968 wrote to memory of 1804	3968	letsvpn.exe	cmd.exe
PID 3968 wrote to memory of 1804	3968	letsvpn.exe	cmd.exe
PID 1804 wrote to memory of 2744	1804	cmd.exe	netsh.exe
PID 1804 wrote to memory of 2744	1804	cmd.exe	netsh.exe
PID 1804 wrote to memory of 2744	1804	cmd.exe	netsh.exe
PID 3968 wrote to memory of 3912	3968	letsvpn.exe	cmd.exe
PID 3968 wrote to memory of 3912	3968	letsvpn.exe	cmd.exe
PID 3968 wrote to memory of 3912	3968	letsvpn.exe	cmd.exe
PID 3912 wrote to memory of 2936	3912	cmd.exe	netsh.exe
PID 3912 wrote to memory of 2936	3912	cmd.exe	netsh.exe
PID 3912 wrote to memory of 2936	3912	cmd.exe	netsh.exe
PID 3968 wrote to memory of 2088	3968	letsvpn.exe	tapinstall.exe
PID 3968 wrote to memory of 2088	3968	letsvpn.exe	tapinstall.exe
PID 3968 wrote to memory of 5100	3968	letsvpn.exe	LetsPRO.exe
PID 3968 wrote to memory of 5100	3968	letsvpn.exe	LetsPRO.exe
PID 3968 wrote to memory of 5100	3968	letsvpn.exe	LetsPRO.exe
PID 5100 wrote to memory of 2468	5100	LetsPRO.exe	LetsPRO.exe
PID 5100 wrote to memory of 2468	5100	LetsPRO.exe	LetsPRO.exe
PID 5100 wrote to memory of 2468	5100	LetsPRO.exe	LetsPRO.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\4f5a8b7ca30c757f4cfcbd338d79dd06ebb6db62451845d7b53f38c54ad7da7a.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2112

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596

C:\Windows\Installer\MSIE313.tmp
"C:\Windows\Installer\MSIE313.tmp"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988

C:\Users\Admin\AppData\Local\Temp\kk.exe
C:\Users\Admin\AppData\Local\Temp\kk.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3784

C:\Users\Public\Pictures\23999\act.exe
C:\Users\Public\Pictures\23999\act.exe 6 23321 fds01234fs56789123afds
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4604

C:\Users\Public\Videos\lsp.exe
C:\Users\Public\Videos\lsp.exe
4⤵
- Executes dropped EXE
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4876 -s 252
5⤵
- Program crash
PID:1256

C:\Windows\SysWOW64\SCHTASKS.exe
SCHTASKS /Create /SC ONLOGON /TN active /F /RL HIGHEST /TR C:\Users\Public\Pictures\23999\ttvip.exe
4⤵
- Creates scheduled task(s)
PID:2980

C:\Users\Admin\AppData\Local\Temp\letsvpn.exe
C:\Users\Admin\AppData\Local\Temp\letsvpn.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1504

C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Windows\SysWOW64\cmd.exe
cmd /c netsh advfirewall firewall Delete rule name=lets
4⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall Delete rule name=lets
5⤵
- Modifies Windows Firewall
PID:3500

C:\Windows\SysWOW64\cmd.exe
cmd /c netsh advfirewall firewall Delete rule name=lets.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall Delete rule name=lets.exe
5⤵
- Modifies Windows Firewall
PID:388

C:\Windows\SysWOW64\cmd.exe
cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall Delete rule name=LetsPRO.exe
5⤵
- Modifies Windows Firewall
PID:2744

C:\Windows\SysWOW64\cmd.exe
cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
4⤵
- Suspicious use of WriteProcessMemory
PID:3912

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall Delete rule name=LetsPRO
5⤵
- Modifies Windows Firewall
PID:2936

C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2088

C:\Program Files (x86)\letsvpn\LetsPRO.exe
"C:\Program Files (x86)\letsvpn\LetsPRO.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100

C:\Program Files (x86)\letsvpn\app-3.2.8\LetsPRO.exe
"C:\Program Files (x86)\letsvpn\app-3.2.8\LetsPRO.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2468

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C ipconfig /all
6⤵
PID:1704

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
7⤵
- Gathers network information
PID:3580

C:\Windows\SysWOW64\netsh.exe
C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
6⤵
PID:3856

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C route print
6⤵
PID:4880

C:\Windows\SysWOW64\ROUTE.EXE
route print
7⤵
PID:1624

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C arp -a
6⤵
PID:3956

C:\Windows\SysWOW64\ARP.EXE
arp -a
7⤵
PID:1116

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4876 -ip 4876
1⤵
PID:728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bd777a28-857b-f748-8d8e-55ac8743bbb6}\oemvista.inf" "9" "4d14a44ff" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\letsvpn\driver"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{07a0512e-09bb-044c-bcc6-243b1d41e81e} Global\{b5bd3fad-65ff-1240-a01a-413a7cb5f1c1} C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\tap0901.cat
3⤵
- Modifies system certificate store
PID:3628

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000148"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:3068

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
Filesize
318B

MD5
b34636a4e04de02d079ba7325e7565f0

SHA1
f32c1211eac22409bb195415cb5a8063431f75cd

SHA256
a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

SHA512
6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

Download Submit
C:\Program Files (x86)\letsvpn\LetsPRO.exe
Filesize
241KB

MD5
d7feeb6db9035951f1acf6f42dff28af

SHA1
433043803f701d2a98af13144c0dbc55b8102fcf

SHA256
7619a4e0d6d4c3c26da4285c6abc69974b4754017fae530768a288e153520be0

SHA512
22785e6f7207c3b6b9ab6fa2f15e78d7fba396eff6ab7e268284bd6379f3b8c7c8ab64ec802d306435d795122ccc5be858895f5ef2a30d5080bfa4ad832dacd8

Download Submit
C:\Program Files (x86)\letsvpn\LetsPRO.exe
Filesize
241KB

MD5
d7feeb6db9035951f1acf6f42dff28af

SHA1
433043803f701d2a98af13144c0dbc55b8102fcf

SHA256
7619a4e0d6d4c3c26da4285c6abc69974b4754017fae530768a288e153520be0

SHA512
22785e6f7207c3b6b9ab6fa2f15e78d7fba396eff6ab7e268284bd6379f3b8c7c8ab64ec802d306435d795122ccc5be858895f5ef2a30d5080bfa4ad832dacd8

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\LetsPRO.exe
Filesize
1.1MB

MD5
f580b1afeda311cc16ec79604013c986

SHA1
c96f803de28e422310a2076f757983b76d4c8516

SHA256
3761076fcc52c1e7dd303496bff5ec64220092f2853e2b6006bf645d61a55092

SHA512
5d0bd2596c2025ae41ff52eabb64916220f879b6c471c743002ab92d609a155127cd7b9ea2100a690e0cd5a48687e91e1f95bc511b9802aefcb173d23da5dba9

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\LetsPRO.exe
Filesize
1.1MB

MD5
f580b1afeda311cc16ec79604013c986

SHA1
c96f803de28e422310a2076f757983b76d4c8516

SHA256
3761076fcc52c1e7dd303496bff5ec64220092f2853e2b6006bf645d61a55092

SHA512
5d0bd2596c2025ae41ff52eabb64916220f879b6c471c743002ab92d609a155127cd7b9ea2100a690e0cd5a48687e91e1f95bc511b9802aefcb173d23da5dba9

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\LetsPRO.exe.config
Filesize
19KB

MD5
bdcc4e908528fd2f68e4d9f96437a842

SHA1
e47b8bf8d5e05a9a486dc33ee246acb2238d200c

SHA256
9a423e934ca02f113551dddd90f96292b0da4b2b9c6144e1163db6bb7c96f92c

SHA512
86a0a4331843d8ac9ac701e1a9dec1ccef69c6d7223fc87366b74b0f186eaab26256088c0ba8c4d5ac42f65adc82be894e6a926887728a800fb160cb87a4f00e

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.Analytics.dll
Filesize
23KB

MD5
a00e81b17b8da7f642a1c0929f8bd545

SHA1
6227fd5c071c0882bbe84f6c6982fc561d250fd3

SHA256
2dac5ef36321d900df3bb785b7974b716fd83a6fe45e847ec5703b981b1bcd63

SHA512
43ab38fd268db0b3185ebaf40deb78655ea21ec7f0d3c3a0f10be2e3768957e027f6ea423214e1e8f7162474871dfb8b90ddc537829794a0b5f8484b9b976426

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.Analytics.dll
Filesize
23KB

MD5
a00e81b17b8da7f642a1c0929f8bd545

SHA1
6227fd5c071c0882bbe84f6c6982fc561d250fd3

SHA256
2dac5ef36321d900df3bb785b7974b716fd83a6fe45e847ec5703b981b1bcd63

SHA512
43ab38fd268db0b3185ebaf40deb78655ea21ec7f0d3c3a0f10be2e3768957e027f6ea423214e1e8f7162474871dfb8b90ddc537829794a0b5f8484b9b976426

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.Analytics.dll
Filesize
23KB

MD5
a00e81b17b8da7f642a1c0929f8bd545

SHA1
6227fd5c071c0882bbe84f6c6982fc561d250fd3

SHA256
2dac5ef36321d900df3bb785b7974b716fd83a6fe45e847ec5703b981b1bcd63

SHA512
43ab38fd268db0b3185ebaf40deb78655ea21ec7f0d3c3a0f10be2e3768957e027f6ea423214e1e8f7162474871dfb8b90ddc537829794a0b5f8484b9b976426

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.Crashes.dll
Filesize
51KB

MD5
21fbbe5187e0fbc7fa715f7e8af3d337

SHA1
7d67fc7c484ac39f7d05f61c365c8ad44f2983c0

SHA256
03e2945affd3d7240bfca83e8d3dea93408f122a8c6ed4945be15483763791f5

SHA512
183156472091a7ac9d778547569c01272a78758faf4e3dc00a9e5b3b34f46d58e64cabdb410913e1ff974b7d326736b31a6828d18810386e09ce9b1d58ce7c61

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.Crashes.dll
Filesize
51KB

MD5
21fbbe5187e0fbc7fa715f7e8af3d337

SHA1
7d67fc7c484ac39f7d05f61c365c8ad44f2983c0

SHA256
03e2945affd3d7240bfca83e8d3dea93408f122a8c6ed4945be15483763791f5

SHA512
183156472091a7ac9d778547569c01272a78758faf4e3dc00a9e5b3b34f46d58e64cabdb410913e1ff974b7d326736b31a6828d18810386e09ce9b1d58ce7c61

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.dll
Filesize
139KB

MD5
ab3b9f954890b81845d6c62a6c48c545

SHA1
67d311c2aa9ca8debcaeaf8b782498c291020aff

SHA256
5192e62c20e2c21683484ffc8f966ed16c262055e0db0fcf94cd2cab7f90231f

SHA512
bf799cb8adb96f8bd91db9ed4950d604001ca721df2a4f0f43426bd74ffb4d1c644f8726e622d80598e2fa3e22417de131424085d8b8828c2a5698fe852fbf6e

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.dll
Filesize
139KB

MD5
ab3b9f954890b81845d6c62a6c48c545

SHA1
67d311c2aa9ca8debcaeaf8b782498c291020aff

SHA256
5192e62c20e2c21683484ffc8f966ed16c262055e0db0fcf94cd2cab7f90231f

SHA512
bf799cb8adb96f8bd91db9ed4950d604001ca721df2a4f0f43426bd74ffb4d1c644f8726e622d80598e2fa3e22417de131424085d8b8828c2a5698fe852fbf6e

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Microsoft.AppCenter.dll
Filesize
139KB

MD5
ab3b9f954890b81845d6c62a6c48c545

SHA1
67d311c2aa9ca8debcaeaf8b782498c291020aff

SHA256
5192e62c20e2c21683484ffc8f966ed16c262055e0db0fcf94cd2cab7f90231f

SHA512
bf799cb8adb96f8bd91db9ed4950d604001ca721df2a4f0f43426bd74ffb4d1c644f8726e622d80598e2fa3e22417de131424085d8b8828c2a5698fe852fbf6e

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Newtonsoft.Json.dll
Filesize
686KB

MD5
22da3e608b9d6510c367a4119aa7226a

SHA1
c46604ca2ddc8b50cbf8249ea7720c1a49703cff

SHA256
74255fe55ff2e6e52f1e38bd9b9b21a0e3bd47d79cd7ddc2c235d3bd36684a7e

SHA512
be4745c006705069bdc3e15ae3bb7e668ce3ba9bccb81feebde62c98b54e9a8b4aed6f9709fb1d9beb5c01d5af1fef84e62c5fc6bafe5d79e92b00785c66f430

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Newtonsoft.Json.dll
Filesize
686KB

MD5
22da3e608b9d6510c367a4119aa7226a

SHA1
c46604ca2ddc8b50cbf8249ea7720c1a49703cff

SHA256
74255fe55ff2e6e52f1e38bd9b9b21a0e3bd47d79cd7ddc2c235d3bd36684a7e

SHA512
be4745c006705069bdc3e15ae3bb7e668ce3ba9bccb81feebde62c98b54e9a8b4aed6f9709fb1d9beb5c01d5af1fef84e62c5fc6bafe5d79e92b00785c66f430

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Newtonsoft.Json.dll
Filesize
686KB

MD5
22da3e608b9d6510c367a4119aa7226a

SHA1
c46604ca2ddc8b50cbf8249ea7720c1a49703cff

SHA256
74255fe55ff2e6e52f1e38bd9b9b21a0e3bd47d79cd7ddc2c235d3bd36684a7e

SHA512
be4745c006705069bdc3e15ae3bb7e668ce3ba9bccb81feebde62c98b54e9a8b4aed6f9709fb1d9beb5c01d5af1fef84e62c5fc6bafe5d79e92b00785c66f430

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Utils.dll
Filesize
118KB

MD5
28a9a91d4b13236fd04a5eaa75e798d0

SHA1
84c064ece148297bf5606cde083ea811ba10a5ef

SHA256
87cf0aeccada8867f1d80f59531403ba8ad0489caf160b6c3401163d61c200fe

SHA512
e49f2aa77cae28b5bab90356fcc318cc2f93b61b1df2d8ceb535106126c85bb09925ab16f9763f4e67dce53a4edf4bb6fa5b2579937ed7372c5af0f513fc09b5

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Utils.dll
Filesize
118KB

MD5
28a9a91d4b13236fd04a5eaa75e798d0

SHA1
84c064ece148297bf5606cde083ea811ba10a5ef

SHA256
87cf0aeccada8867f1d80f59531403ba8ad0489caf160b6c3401163d61c200fe

SHA512
e49f2aa77cae28b5bab90356fcc318cc2f93b61b1df2d8ceb535106126c85bb09925ab16f9763f4e67dce53a4edf4bb6fa5b2579937ed7372c5af0f513fc09b5

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\Utils.dll
Filesize
118KB

MD5
28a9a91d4b13236fd04a5eaa75e798d0

SHA1
84c064ece148297bf5606cde083ea811ba10a5ef

SHA256
87cf0aeccada8867f1d80f59531403ba8ad0489caf160b6c3401163d61c200fe

SHA512
e49f2aa77cae28b5bab90356fcc318cc2f93b61b1df2d8ceb535106126c85bb09925ab16f9763f4e67dce53a4edf4bb6fa5b2579937ed7372c5af0f513fc09b5

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\libwin.dll
Filesize
8.8MB

MD5
b9323c5b974dcf2e9fc36c01b76e39ff

SHA1
3a91204bbcdc1fd9439f79efd7bd7c4cc69ab972

SHA256
8d48f8230b96fcb6b6468b958fa796a5204ffcd310aa9522b1b0e21acfd50ed2

SHA512
0194408bbf816909f2c066f0da12a22002bdfa01514a1b98bb30205866bc67922f64529766725a0298e526b2e5ee5b4223ec04a2ead18b8432e1c68d61d8bc02

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\libwin.dll
Filesize
8.8MB

MD5
b9323c5b974dcf2e9fc36c01b76e39ff

SHA1
3a91204bbcdc1fd9439f79efd7bd7c4cc69ab972

SHA256
8d48f8230b96fcb6b6468b958fa796a5204ffcd310aa9522b1b0e21acfd50ed2

SHA512
0194408bbf816909f2c066f0da12a22002bdfa01514a1b98bb30205866bc67922f64529766725a0298e526b2e5ee5b4223ec04a2ead18b8432e1c68d61d8bc02

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\log4net.config
Filesize
3KB

MD5
28f9077c304d8c626554818a5b5f3b3a

SHA1
a01f735fe348383795d61aadd6aab0cc3a9db190

SHA256
746b5675ea85c21ef4fcc05e072383a7f83c5fe06aaa391fc3046f34b9817c90

SHA512
485c175bc13c64601b15243daecbf72621883c2ff294852c9bbb2681937f7ef0bea65361e0f83131ec989432326442ef387c1ccf2a7ca537c6788b8fd5c0021e

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\log4net.dll
Filesize
274KB

MD5
985916905fc9b8222c3e65c8873cab91

SHA1
95c7ce0a1d94918a234694f1917d9eef3b289035

SHA256
252a303763cf7810679255cfbf761d2a5ce3b41b193070f0c5ebcbc52238e1c8

SHA512
436b0d24a7e23ab424dce69608969f35fcc88b4caa5c1bb2eeaee8bf54a4c2c0c9cbfe3a0e82c81fae22d1acdb037648972c6860e831a851fb42276ff5e97354

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\log4net.dll
Filesize
274KB

MD5
985916905fc9b8222c3e65c8873cab91

SHA1
95c7ce0a1d94918a234694f1917d9eef3b289035

SHA256
252a303763cf7810679255cfbf761d2a5ce3b41b193070f0c5ebcbc52238e1c8

SHA512
436b0d24a7e23ab424dce69608969f35fcc88b4caa5c1bb2eeaee8bf54a4c2c0c9cbfe3a0e82c81fae22d1acdb037648972c6860e831a851fb42276ff5e97354

Download Submit
C:\Program Files (x86)\letsvpn\app-3.2.8\log4net.dll
Filesize
274KB

MD5
985916905fc9b8222c3e65c8873cab91

SHA1
95c7ce0a1d94918a234694f1917d9eef3b289035

SHA256
252a303763cf7810679255cfbf761d2a5ce3b41b193070f0c5ebcbc52238e1c8

SHA512
436b0d24a7e23ab424dce69608969f35fcc88b4caa5c1bb2eeaee8bf54a4c2c0c9cbfe3a0e82c81fae22d1acdb037648972c6860e831a851fb42276ff5e97354

Download Submit
C:\Program Files (x86)\letsvpn\driver\OemVista.inf
Filesize
7KB

MD5
87868193626dc756d10885f46d76f42e

SHA1
94a5ce8ed7633ed77531b6cb14ceb1927c5cae1f

SHA256
b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41

SHA512
79751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277

Download Submit
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Filesize
90KB

MD5
d10f74d86cd350732657f542df533f82

SHA1
c54074f8f162a780819175e7169c43f6706ad46c

SHA256
c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67

SHA512
0d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e

Download Submit
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Filesize
90KB

MD5
d10f74d86cd350732657f542df533f82

SHA1
c54074f8f162a780819175e7169c43f6706ad46c

SHA256
c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67

SHA512
0d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e

Download Submit
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Filesize
90KB

MD5
d10f74d86cd350732657f542df533f82

SHA1
c54074f8f162a780819175e7169c43f6706ad46c

SHA256
c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67

SHA512
0d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e

Download Submit
C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
Filesize
90KB

MD5
d10f74d86cd350732657f542df533f82

SHA1
c54074f8f162a780819175e7169c43f6706ad46c

SHA256
c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67

SHA512
0d7cb060e4a9482d4862ff47c9d6f52a060c4fb4e3b8388769fa2974ccf081af6bea7b1d4325c03d128bc4de6e0525d6e9bf3a42564391f2acd980435a0dd87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\kk.exe
Filesize
75KB

MD5
6050e96866489fe27ed9babad1857036

SHA1
64f2bbb3e24a665b119fed0aea149eda7723ca24

SHA256
7b1e8fe7a9f17c6225df8151506724c6ad2d7e469593bb4095427ee430b617ad

SHA512
ce528812778066db7323e0ebce59ec350574713260abd8e9cfbabbff94ec6dad2c6beeb8998c2e7fcb62938a57a3e13596ea23407551563ab22624f7a89cd809

Download Submit
C:\Users\Admin\AppData\Local\Temp\kk.exe
Filesize
75KB

MD5
6050e96866489fe27ed9babad1857036

SHA1
64f2bbb3e24a665b119fed0aea149eda7723ca24

SHA256
7b1e8fe7a9f17c6225df8151506724c6ad2d7e469593bb4095427ee430b617ad

SHA512
ce528812778066db7323e0ebce59ec350574713260abd8e9cfbabbff94ec6dad2c6beeb8998c2e7fcb62938a57a3e13596ea23407551563ab22624f7a89cd809

Download Submit
C:\Users\Admin\AppData\Local\Temp\letsvpn.exe
Filesize
12.3MB

MD5
8834ec8d35669dd623ba5c6986ff2748

SHA1
1a475633f1ea1ab47edb1c030ce2ea933c0a934c

SHA256
addd2cd8d45632e65f49b6ce71614af32332741307be5a02f16015af13090cf2

SHA512
00b3578f4e79a5af041dc2364b2cbcc73930c5d1893b3646d8eb652c89573773abc9dc9bf1de2aff05053942a1615cbe17c0ed6ce0e019b649f0b11301cbcf4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\letsvpn.exe
Filesize
12.3MB

MD5
8834ec8d35669dd623ba5c6986ff2748

SHA1
1a475633f1ea1ab47edb1c030ce2ea933c0a934c

SHA256
addd2cd8d45632e65f49b6ce71614af32332741307be5a02f16015af13090cf2

SHA512
00b3578f4e79a5af041dc2364b2cbcc73930c5d1893b3646d8eb652c89573773abc9dc9bf1de2aff05053942a1615cbe17c0ed6ce0e019b649f0b11301cbcf4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\System.dll
Filesize
11KB

MD5
75ed96254fbf894e42058062b4b4f0d1

SHA1
996503f1383b49021eb3427bc28d13b5bbd11977

SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsDialogs.dll
Filesize
9KB

MD5
ca95c9da8cef7062813b989ab9486201

SHA1
c555af25df3de51aa18d487d47408d5245dba2d1

SHA256
feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be

SHA512
a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsExec.dll
Filesize
6KB

MD5
3d366250fcf8b755fce575c75f8c79e4

SHA1
2ebac7df78154738d41aac8e27d7a0e482845c57

SHA256
8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

SHA512
67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvEE9C.tmp\nsProcess.dll
Filesize
4KB

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BD777~1\tap0901.cat
Filesize
19KB

MD5
c757503bc0c5a6679e07fe15b93324d6

SHA1
6a81aa87e4b07c7fea176c8adf1b27ddcdd44573

SHA256
91ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e

SHA512
efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99

Download Submit
C:\Users\Admin\AppData\Local\Temp\{BD777~1\tap0901.sys
Filesize
26KB

MD5
d765f43cbea72d14c04af3d2b9c8e54b

SHA1
daebe266073616e5fc931c319470fcf42a06867a

SHA256
89c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0

SHA512
ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{bd777a28-857b-f748-8d8e-55ac8743bbb6}\oemvista.inf
Filesize
7KB

MD5
87868193626dc756d10885f46d76f42e

SHA1
94a5ce8ed7633ed77531b6cb14ceb1927c5cae1f

SHA256
b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41

SHA512
79751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277

Download Submit
C:\Users\Public\Pictures\23999\act.exe
Filesize
225KB

MD5
2948e1979ceb27384ea7f04348a7ecf1

SHA1
5dd956e1c15e86ec9ca3f9d6c317ad76a2f20eb9

SHA256
e875be898d622c1d03a383ca8fed987e34bd8b47effee0044a38cc68012b49c1

SHA512
bf2168d807570e910f33b8bec9d64feceaef340f65aa3face2b5ed848977931bf9392bf4f326294638729907a6dc0ab453cee99fcbc3f691388252b50dbd978b

Download Submit
C:\Users\Public\Pictures\23999\act.exe
Filesize
225KB

MD5
2948e1979ceb27384ea7f04348a7ecf1

SHA1
5dd956e1c15e86ec9ca3f9d6c317ad76a2f20eb9

SHA256
e875be898d622c1d03a383ca8fed987e34bd8b47effee0044a38cc68012b49c1

SHA512
bf2168d807570e910f33b8bec9d64feceaef340f65aa3face2b5ed848977931bf9392bf4f326294638729907a6dc0ab453cee99fcbc3f691388252b50dbd978b

Download Submit
C:\Users\Public\Videos\lsp.exe
Filesize
1.0MB

MD5
95f15e5ca91150a6caf86ada3023cc58

SHA1
6254bb5d18d7ccff4c698ec771c9bed56653d117

SHA256
2a013ff275babc22d4a7041cb52dbd641aa918227cf4943a6ec927d89f9fccad

SHA512
bcf827c2aae0bb58f2c10e25767b89b957d4ef00f4f83ef73d02609d6359037f3f11f683838319f6d39e0db6eadea9ae7f4f5f08f0fd8efa1bf52c77094f7f40

Download Submit
C:\Users\Public\Videos\lsp.exe
Filesize
1.0MB

MD5
95f15e5ca91150a6caf86ada3023cc58

SHA1
6254bb5d18d7ccff4c698ec771c9bed56653d117

SHA256
2a013ff275babc22d4a7041cb52dbd641aa918227cf4943a6ec927d89f9fccad

SHA512
bcf827c2aae0bb58f2c10e25767b89b957d4ef00f4f83ef73d02609d6359037f3f11f683838319f6d39e0db6eadea9ae7f4f5f08f0fd8efa1bf52c77094f7f40

Download Submit
C:\Windows\INF\oem2.inf
Filesize
7KB

MD5
87868193626dc756d10885f46d76f42e

SHA1
94a5ce8ed7633ed77531b6cb14ceb1927c5cae1f

SHA256
b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41

SHA512
79751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277

Download Submit
C:\Windows\Installer\MSIE313.tmp
Filesize
13.5MB

MD5
527111c6ff1bed78302d2a59a772bebe

SHA1
94dcdb1aa606356a613584e016d201fe9246e0f3

SHA256
97935af097104cb5cbafefb482f1e748613eeb6dadf80bc95c88fcc2aac6580c

SHA512
12c30789892746c02478ac9f920f3b6eeb37de2d36b432ba3aa4e13980eeffa869cf0be381c9a50f80dabbdfdd5d61a0a36c53dcf55ecf37b6b50690f4dae6e8

Download Submit
C:\Windows\Installer\MSIE313.tmp
Filesize
13.5MB

MD5
527111c6ff1bed78302d2a59a772bebe

SHA1
94dcdb1aa606356a613584e016d201fe9246e0f3

SHA256
97935af097104cb5cbafefb482f1e748613eeb6dadf80bc95c88fcc2aac6580c

SHA512
12c30789892746c02478ac9f920f3b6eeb37de2d36b432ba3aa4e13980eeffa869cf0be381c9a50f80dabbdfdd5d61a0a36c53dcf55ecf37b6b50690f4dae6e8

Download Submit
C:\Windows\System32\DriverStore\FileRepository\OEMVIS~1.INF\tap0901.sys
Filesize
26KB

MD5
d765f43cbea72d14c04af3d2b9c8e54b

SHA1
daebe266073616e5fc931c319470fcf42a06867a

SHA256
89c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0

SHA512
ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2

Download Submit
C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\oemvista.inf
Filesize
7KB

MD5
87868193626dc756d10885f46d76f42e

SHA1
94a5ce8ed7633ed77531b6cb14ceb1927c5cae1f

SHA256
b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41

SHA512
79751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277

Download Submit
C:\Windows\System32\DriverStore\Temp\{30977b27-0abe-e547-9021-2f9beef2aa22}\tap0901.cat
Filesize
19KB

MD5
c757503bc0c5a6679e07fe15b93324d6

SHA1
6a81aa87e4b07c7fea176c8adf1b27ddcdd44573

SHA256
91ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e

SHA512
efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
f7d257dfacdcb5944b66cb758d95908e

SHA1
876217a545605f4cc76e2465bda6c167bbbd43e4

SHA256
6eae9031e9d579833e0edaf395856b9758e9ee9cafa2cc5a46d4cfc5c33c1b58

SHA512
60062ffd6993fdb45f9b5df21eb077c9a9096a3ec01919a35250abaf50fd123a25adf89efab2a9819d1dd4533415d7583e58711524ae41c78ff21d1eff66e696

Download Submit
\??\Volume{06969d78-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f7dca561-2c1a-4bd1-97b9-967e140484eb}_OnDiskSnapshotProp
Filesize
5KB

MD5
1f505a948486af4872a2f433023108e4

SHA1
f523690b61b793620f174b614105ab433708774d

SHA256
22543b41144f07bc18ab4287106261f8c3b513bdd33044641fb04218188e67aa

SHA512
074586d210662dafe81d66517a88a3c180a95aaa9ec5e20544d3f29685e7e3d80657eb98ef1fc2900014f6ad65dad6ee4050364b0896ba6c951d5f2c50203539

Download Submit
\??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
Filesize
26KB

MD5
d765f43cbea72d14c04af3d2b9c8e54b

SHA1
daebe266073616e5fc931c319470fcf42a06867a

SHA256
89c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0

SHA512
ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2

Download Submit
\??\c:\program files (x86)\letsvpn\driver\tap0901.cat
Filesize
19KB

MD5
c757503bc0c5a6679e07fe15b93324d6

SHA1
6a81aa87e4b07c7fea176c8adf1b27ddcdd44573

SHA256
91ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e

SHA512
efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99

Download Submit
memory/388-216-0x0000000000000000-mapping.dmp

Download
memory/736-208-0x0000000000000000-mapping.dmp

Download
memory/1116-294-0x0000000000000000-mapping.dmp

Download
memory/1412-212-0x0000000000000000-mapping.dmp

Download
memory/1504-190-0x0000000000000000-mapping.dmp

Download
memory/1596-132-0x0000000000000000-mapping.dmp

Download
memory/1624-292-0x0000000000000000-mapping.dmp

Download
memory/1704-285-0x0000000000000000-mapping.dmp

Download
memory/1804-218-0x0000000000000000-mapping.dmp

Download
memory/1844-215-0x0000000000000000-mapping.dmp

Download
memory/1976-200-0x0000000000000000-mapping.dmp

Download
memory/2088-224-0x0000000000000000-mapping.dmp

Download
memory/2344-172-0x0000000006F00000-0x0000000006F0A000-memory.dmp

Filesize
40KB

Download
memory/2344-171-0x0000000006E80000-0x0000000006E9A000-memory.dmp

Filesize
104KB

Download
memory/2344-159-0x0000000000000000-mapping.dmp

Download
memory/2344-160-0x0000000002280000-0x00000000022B6000-memory.dmp

Filesize
216KB

Download
memory/2344-161-0x0000000004D70000-0x0000000005398000-memory.dmp

Filesize
6.2MB

Download
memory/2344-162-0x0000000004BD0000-0x0000000004BF2000-memory.dmp

Filesize
136KB

Download
memory/2344-163-0x00000000054A0000-0x0000000005506000-memory.dmp

Filesize
408KB

Download
memory/2344-164-0x0000000005580000-0x00000000055E6000-memory.dmp

Filesize
408KB

Download
memory/2344-165-0x0000000005B80000-0x0000000005B9E000-memory.dmp

Filesize
120KB

Download
memory/2344-188-0x0000000007110000-0x0000000007118000-memory.dmp

Filesize
32KB

Download
memory/2344-187-0x00000000071D0000-0x00000000071EA000-memory.dmp

Filesize
104KB

Download
memory/2344-186-0x00000000070D0000-0x00000000070DE000-memory.dmp

Filesize
56KB

Download
memory/2344-167-0x0000000006D40000-0x0000000006D72000-memory.dmp

Filesize
200KB

Download
memory/2344-168-0x000000006FE10000-0x000000006FE5C000-memory.dmp

Filesize
304KB

Download
memory/2344-169-0x0000000006140000-0x000000000615E000-memory.dmp

Filesize
120KB

Download
memory/2344-178-0x0000000007130000-0x00000000071C6000-memory.dmp

Filesize
600KB

Download
memory/2344-170-0x0000000007540000-0x0000000007BBA000-memory.dmp

Filesize
6.5MB

Download
memory/2468-259-0x0000000037D30000-0x0000000037D56000-memory.dmp

Filesize
152KB

Download
memory/2468-277-0x000000003F890000-0x000000003F8A2000-memory.dmp

Filesize
72KB

Download
memory/2468-289-0x0000000041960000-0x0000000041968000-memory.dmp

Filesize
32KB

Download
memory/2468-234-0x0000000000C00000-0x0000000000D1E000-memory.dmp

Filesize
1.1MB

Download
memory/2468-230-0x0000000000000000-mapping.dmp

Download
memory/2468-288-0x00000000410B0000-0x00000000410FA000-memory.dmp

Filesize
296KB

Download
memory/2468-286-0x0000000040FE0000-0x0000000041002000-memory.dmp

Filesize
136KB

Download
memory/2468-238-0x00000000055E0000-0x0000000005602000-memory.dmp

Filesize
136KB

Download
memory/2468-284-0x000000003F8E0000-0x000000003F8F0000-memory.dmp

Filesize
64KB

Download
memory/2468-283-0x0000000040D30000-0x0000000040D62000-memory.dmp

Filesize
200KB

Download
memory/2468-242-0x0000000005A30000-0x0000000005A76000-memory.dmp

Filesize
280KB

Download
memory/2468-282-0x0000000040CB0000-0x0000000040D26000-memory.dmp

Filesize
472KB

Download
memory/2468-281-0x000000003F620000-0x000000003F630000-memory.dmp

Filesize
64KB

Download
memory/2468-280-0x000000003F600000-0x000000003F616000-memory.dmp

Filesize
88KB

Download
memory/2468-279-0x000000003F5D0000-0x000000003F5E0000-memory.dmp

Filesize
64KB

Download
memory/2468-278-0x000000003F8C0000-0x000000003F8DE000-memory.dmp

Filesize
120KB

Download
memory/2468-247-0x0000000005D30000-0x0000000005DE0000-memory.dmp

Filesize
704KB

Download
memory/2468-248-0x0000000006880000-0x0000000006DAC000-memory.dmp

Filesize
5.2MB

Download
memory/2468-276-0x000000003F920000-0x000000003FAA6000-memory.dmp

Filesize
1.5MB

Download
memory/2468-275-0x000000003E8F0000-0x000000003E8FE000-memory.dmp

Filesize
56KB

Download
memory/2468-251-0x0000000038030000-0x00000000385D4000-memory.dmp

Filesize
5.6MB

Download
memory/2468-255-0x00000000376D0000-0x00000000376DA000-memory.dmp

Filesize
40KB

Download
memory/2468-274-0x000000003E920000-0x000000003E958000-memory.dmp

Filesize
224KB

Download
memory/2468-262-0x00000000376E0000-0x00000000376F0000-memory.dmp

Filesize
64KB

Download
memory/2468-273-0x000000003EA30000-0x000000003EA38000-memory.dmp

Filesize
32KB

Download
memory/2468-272-0x000000003E9E0000-0x000000003E9EA000-memory.dmp

Filesize
40KB

Download
memory/2468-271-0x000000003E990000-0x000000003E998000-memory.dmp

Filesize
32KB

Download
memory/2468-270-0x000000003E980000-0x000000003E988000-memory.dmp

Filesize
32KB

Download
memory/2468-269-0x000000003E9B0000-0x000000003E9D6000-memory.dmp

Filesize
152KB

Download
memory/2468-268-0x000000003A3B0000-0x000000003A3C4000-memory.dmp

Filesize
80KB

Download
memory/2468-267-0x000000003A390000-0x000000003A3A2000-memory.dmp

Filesize
72KB

Download
memory/2468-266-0x000000003A370000-0x000000003A38A000-memory.dmp

Filesize
104KB

Download
memory/2468-263-0x0000000037E00000-0x0000000037E92000-memory.dmp

Filesize
584KB

Download
memory/2468-264-0x00000000386E0000-0x000000003871A000-memory.dmp

Filesize
232KB

Download
memory/2468-265-0x000000003A340000-0x000000003A348000-memory.dmp

Filesize
32KB

Download
memory/2744-219-0x0000000000000000-mapping.dmp

Download
memory/2936-222-0x0000000000000000-mapping.dmp

Download
memory/2980-176-0x0000000000000000-mapping.dmp

Download
memory/3500-213-0x0000000000000000-mapping.dmp

Download
memory/3580-287-0x0000000000000000-mapping.dmp

Download
memory/3628-204-0x0000000000000000-mapping.dmp

Download
memory/3784-142-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3784-144-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3784-138-0x0000000000000000-mapping.dmp

Download
memory/3856-290-0x0000000000000000-mapping.dmp

Download
memory/3912-221-0x0000000000000000-mapping.dmp

Download
memory/3956-293-0x0000000000000000-mapping.dmp

Download
memory/3968-141-0x0000000000000000-mapping.dmp

Download
memory/3988-133-0x0000000000000000-mapping.dmp

Download
memory/3988-156-0x0000000000400000-0x0000000001DFA000-memory.dmp

Filesize
26.0MB

Download
memory/3988-136-0x0000000000400000-0x0000000001DFA000-memory.dmp

Filesize
26.0MB

Download
memory/3988-137-0x0000000000400000-0x0000000001DFA000-memory.dmp

Filesize
26.0MB

Download
memory/4604-193-0x00007FF71EF10000-0x00007FF71EF90000-memory.dmp

Filesize
512KB

Download
memory/4604-153-0x00007FF71EF10000-0x00007FF71EF90000-memory.dmp

Filesize
512KB

Download
memory/4604-151-0x00007FF71EF10000-0x00007FF71EF90000-memory.dmp

Filesize
512KB

Download
memory/4604-148-0x0000000000000000-mapping.dmp

Download
memory/4612-195-0x0000000000000000-mapping.dmp

Download
memory/4876-179-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/4876-180-0x0000000010000000-0x0000000010192000-memory.dmp

Filesize
1.6MB

Download
memory/4876-177-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/4876-173-0x0000000000000000-mapping.dmp

Download
memory/4876-207-0x0000000000400000-0x00000000006A8000-memory.dmp

Filesize
2.7MB

Download
memory/4880-291-0x0000000000000000-mapping.dmp

Download
memory/5100-227-0x0000000000000000-mapping.dmp

Download