1a2e029e9910f3a3aee454b44f28db7f2a4e6078a108e92876483cff08769825

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IesVpn-winx64.exe
Size

36.3MB
MD5

680e7c4978fd2a85ebc5e7af6da2e2a8
SHA1

4a2b353da3a43a45fdfa2f121a01cec31ee9518a
SHA256

1a2e029e9910f3a3aee454b44f28db7f2a4e6078a108e92876483cff08769825
SHA512

1e16682d12763970366ef91448faf14aaea990011dab71865903c1e1de1dea33591cc27151670281b6bf4c0a3d625ee91eb71f937e7cc0d6354a65f17bea2cc6
SSDEEP

786432:3eDkNsEq0/QflO3w3wmYu0X6pwOOMuygT/hr2R+Q/:OANFsObmYGeOOtygTpr1Q/

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET4911.tmp	DrvInst.exe
File created	C:\Windows\system32\DRIVERS\SET4911.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\tap0901.sys	DrvInst.exe

Executes dropped EXE 10 IoCs

pid	Process
2496	IesVpn-winx64.tmp
1164	updervn.exe
2432	VaLvczhal.exe
1480	VaLvczhal.exe
476	Process not Found
2856	VaLvczhal.exe
2272	VaLvczhal.exe
1304	VaLvczhal.exe
2416	LetsPRO.exe
2240	tapinstall.exe

Loads dropped DLL 64 IoCs

pid	Process
3056	IesVpn-winx64.exe
2496	IesVpn-winx64.tmp
1164	updervn.exe
1228	Process not Found
1164	updervn.exe
2432	VaLvczhal.exe
1480	VaLvczhal.exe
2856	VaLvczhal.exe
2272	VaLvczhal.exe
1304	VaLvczhal.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
644	cmd.exe
644	cmd.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\LetsPRO = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\LetVProtecter\\letsvpn\\app-3.9.0\\LetsPRO.exe\" /silent"	LetsPRO.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	VaLvczhal.exe
File opened (read-only)	\??\I:	VaLvczhal.exe
File opened (read-only)	\??\L:	VaLvczhal.exe
File opened (read-only)	\??\W:	VaLvczhal.exe
File opened (read-only)	\??\Y:	VaLvczhal.exe
File opened (read-only)	\??\V:	VaLvczhal.exe
File opened (read-only)	\??\B:	VaLvczhal.exe
File opened (read-only)	\??\E:	VaLvczhal.exe
File opened (read-only)	\??\N:	VaLvczhal.exe
File opened (read-only)	\??\T:	VaLvczhal.exe
File opened (read-only)	\??\R:	VaLvczhal.exe
File opened (read-only)	\??\S:	VaLvczhal.exe
File opened (read-only)	\??\X:	VaLvczhal.exe
File opened (read-only)	\??\G:	VaLvczhal.exe
File opened (read-only)	\??\H:	VaLvczhal.exe
File opened (read-only)	\??\J:	VaLvczhal.exe
File opened (read-only)	\??\K:	VaLvczhal.exe
File opened (read-only)	\??\U:	VaLvczhal.exe
File opened (read-only)	\??\M:	VaLvczhal.exe
File opened (read-only)	\??\O:	VaLvczhal.exe
File opened (read-only)	\??\P:	VaLvczhal.exe
File opened (read-only)	\??\Q:	VaLvczhal.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
600	cmd.exe
1644	ARP.EXE

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_neutral_662fd96dfdced4ae\oemvista.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	tapinstall.exe
File created	C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\SET1278.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\SET127A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\SET1278.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\SET1279.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\SET127A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_neutral_662fd96dfdced4ae\oemvista.PNF	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	tapinstall.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\oemvista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\SET1279.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	tapinstall.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 29 IoCs

pid	Process
1164	updervn.exe
1164	updervn.exe
2432	VaLvczhal.exe
2432	VaLvczhal.exe
1480	VaLvczhal.exe
1480	VaLvczhal.exe
2856	VaLvczhal.exe
2856	VaLvczhal.exe
1304	VaLvczhal.exe
2272	VaLvczhal.exe
1304	VaLvczhal.exe
2856	VaLvczhal.exe
1304	VaLvczhal.exe
2856	VaLvczhal.exe
1304	VaLvczhal.exe
2856	VaLvczhal.exe
1304	VaLvczhal.exe
2856	VaLvczhal.exe
1304	VaLvczhal.exe
2856	VaLvczhal.exe
1304	VaLvczhal.exe
2856	VaLvczhal.exe
1304	VaLvczhal.exe
2856	VaLvczhal.exe
1304	VaLvczhal.exe
2856	VaLvczhal.exe
1304	VaLvczhal.exe
2856	VaLvczhal.exe
1304	VaLvczhal.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\VaLvczhal\zlibai.dll	VaLvczhal.exe
File opened for modification	C:\Windows\VaLvczhal\zlibai.dll	VaLvczhal.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\VaLvczhal\support_report.inf	VaLvczhal.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File created	C:\Windows\INF\oem2.PNF	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File created	C:\Windows\VaLvczhal\VaLvczhal.exe	VaLvczhal.exe
File opened for modification	C:\Windows\VaLvczhal\support_report.inf	VaLvczhal.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\VaLvczhal\VaLvczhal.exe	VaLvczhal.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	tapinstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LetsPRO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IesVpn-winx64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IesVpn-winx64.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2888	ipconfig.exe

Modifies data under HKEY_USERS 57 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@netcfgx.dll,-50003 = "Allows other computers to access resources on your computer using a Microsoft network."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\lltdres.dll,-3 = "Allows this PC to be discovered and located on the network."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@netcfgx.dll,-50002 = "Allows your computer to access resources on a Microsoft network."	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tcpipcfg.dll,-50001 = "Transmission Control Protocol/Internet Protocol. The default wide area network protocol that provides communication across diverse interconnected networks."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\rascfg.dll,-32010 = "Provides the abilitiy to connect a host to a Remote Access Concentrator that supports RFC2516."	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\System32\drivers\pacer.sys,-100 = "Quality of Service Packet Scheduler. This component provides network traffic control, including rate-of-flow and prioritization services."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\sstpsvc.dll,-203 = "Allows you to securely connect to a private network using the Internet."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tcpipcfg.dll,-50002 = "TCP/IP version 6. The latest version of the internet protocol that provides communication across diverse interconnected networks."	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\rascfg.dll,-32008 = "Allows you to securely connect to a private network using the Internet."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\lltdres.dll,-4 = "Used to discover and locate other PCs, devices, and network infrastructure components on the network. Also used to determine network bandwidth."	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%systemroot%\system32\rascfg.dll,-32009 = "Allows you to securely connect to a private network using the Internet."	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\URL Protocol = "C:\\Users\\Admin\\AppData\\Local\\Programs\\LetVProtecter\\letsvpn\\app-3.9.0\\LetsPRO.exe"	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\LetVProtecter\\letsvpn\\app-3.9.0\\LetsPRO.exe\",1"	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\ = "letsvpn2Protocol"	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\LetVProtecter\\letsvpn\\app-3.9.0\\LetsPRO.exe\" \"%1\""	LetsPRO.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\SystemCertificates\CA\Certificates\329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692	LetsPRO.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\SystemCertificates\CA\Certificates\329B78A5C9EBC2043242DE90CE1B7C6B1BA6C692\Blob = 030000000100000014000000329b78a5c9ebc2043242de90ce1b7c6b1ba6c6921900000001000000100000000e8c3d8a006eb5c23a7725464ad10a8c0400000001000000100000002aa320982e00193fad3bd0ea5406e4cd0f0000000100000030000000a229d2722bc6091d73b1d979b81088c977cb028a6f7cbf264bb81d5cc8f099f87d7c296e48bf09d7ebe275f5498661a414000000010000001400000032eb929aff3596482f284042702036915c1785e61800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000730500003082056f30820457a003020102021048fc93b46055948d36a7c98a89d69416300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3231303532353030303030305a170d3238313233313233353935395a3056310b300906035504061302474231183016060355040a130f5365637469676f204c696d69746564312d302b060355040313245365637469676f205075626c696320436f6465205369676e696e6720526f6f742052343630820222300d06092a864886f70d01010105000382020f003082020a02820201008de79412220424742eff162302928ab6ae3685ac47d423912b3edc7de231a0516fac8491e3528ab5e296ded0876324898affef12933b7dbbb68abdbd057f279b6b65d3a50c69b1bc49399af16d6eaae4a08327da9a0d2b50e94b5bb3b86436a47e4a3da971ab61b373b33c0b0cefdb3357e5be3437e3971b5dfd1f123d820376e6fb3f66d2943169fa6db334acc17a78dc9250f264c7aa2d04abc36aeae02fa7a7dc6ed7e8ffda21ab40bfb9ee0d9ec6d99e99efc6de1fa90c76b32720a1d6bafd80e701d2efeb822995708dffbb15cffed10f36a22e4f329074466b4735137705334f632eb82de1bf65a7046b18d871facc08f26d899910b1addb3e2ce4aa18b0c607017567de6de963631e367f6989beaa453e6e5a5f8fa15bcb9d308630e803b340c60d0f38cd67a85388fab83065fa6fc7e71db18374693eacc4683bb1e667339ab608e080054840eef6826446a8f573b00695f26c659fbf555b1c9c571ac778467c70aa941b8217ac87e9b6c90e811c40d6161729fc5c9c182bea45f5efbdd5674f285e05ee904c7ae7c6f4d0fcfacd3e32461320368a04eab7aa07469c0d933a096699585c29a3b90ca630383cd04636357c9cbaeec3d5f90a76fa7e051b40ca9235e9d57ad1b57f00aea990aac57f019c10b116fccc6e18dc6f62fea650a7b87bb89d153ffe200c75c8225a1395199000e91ad5c286f1e38eec5ff4e50203010001a38201123082010e301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e0416041432eb929aff3596482f284042702036915c1785e6300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070303301b0603551d200414301230060604551d20003008060667810c01040130430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c0500038201010012bfa1ef8b749a9844b86946b5ab240a0ca48a67b83a81bf458a7d5207a88d1f4e218539a36b5e2d2086bf10b8ae793b53cdb4fbd844be06d95c6367d44016874486722ad63215f51283c2f9e15d114067f6422772c523e202381a4c20e2db01f7cd464f26a27c66c05136b6890254c7fc58fb6c00eefe98a62e95a10c53291f6fd819a64f9ef7ac09ea5d82c68baf80a7bd8148528431da32ec15e4a64c3d6c3973d40b853920e0851a68e1a74838a9d1362577c18d1916c5884c667d2f63ce98e869dfac3ca85d9dc91c5baed8f32f74cfb87ef6d7839d1196629aae4513da7fdc47fbdfc3529fe60655e99d8cf23a6251bcec240f29d4588084e4457b5ad8	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	LetsPRO.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	LetsPRO.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	LetsPRO.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	LetsPRO.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2496	IesVpn-winx64.tmp
2496	IesVpn-winx64.tmp
2856	VaLvczhal.exe
2856	VaLvczhal.exe
2856	VaLvczhal.exe
2856	VaLvczhal.exe
2856	VaLvczhal.exe
2856	VaLvczhal.exe
2856	VaLvczhal.exe
2856	VaLvczhal.exe
2856	VaLvczhal.exe
2856	VaLvczhal.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	Process not Found
476	Process not Found

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	LetsPRO.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	928	rundll32.exe
Token: SeRestorePrivilege	928	rundll32.exe
Token: SeRestorePrivilege	928	rundll32.exe
Token: SeRestorePrivilege	928	rundll32.exe
Token: SeRestorePrivilege	928	rundll32.exe
Token: SeRestorePrivilege	928	rundll32.exe
Token: SeRestorePrivilege	928	rundll32.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeBackupPrivilege	2632	vssvc.exe
Token: SeRestorePrivilege	2632	vssvc.exe
Token: SeAuditPrivilege	2632	vssvc.exe
Token: SeBackupPrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1980	DrvInst.exe
Token: SeRestorePrivilege	1800	DrvInst.exe
Token: SeRestorePrivilege	1800	DrvInst.exe
Token: SeRestorePrivilege	1800	DrvInst.exe
Token: SeRestorePrivilege	1800	DrvInst.exe
Token: SeRestorePrivilege	1800	DrvInst.exe
Token: SeRestorePrivilege	1800	DrvInst.exe
Token: SeRestorePrivilege	1800	DrvInst.exe
Token: SeLoadDriverPrivilege	1800	DrvInst.exe
Token: SeLoadDriverPrivilege	1800	DrvInst.exe
Token: SeLoadDriverPrivilege	1800	DrvInst.exe
Token: SeRestorePrivilege	2240	tapinstall.exe
Token: SeLoadDriverPrivilege	2240	tapinstall.exe
Token: SeRestorePrivilege	1336	DrvInst.exe
Token: SeRestorePrivilege	1336	DrvInst.exe
Token: SeRestorePrivilege	1336	DrvInst.exe
Token: SeRestorePrivilege	1336	DrvInst.exe
Token: SeRestorePrivilege	1336	DrvInst.exe
Token: SeRestorePrivilege	1336	DrvInst.exe
Token: SeRestorePrivilege	1336	DrvInst.exe
Token: SeRestorePrivilege	1336	DrvInst.exe
Token: SeLoadDriverPrivilege	1336	DrvInst.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2496	IesVpn-winx64.tmp
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe
2416	LetsPRO.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1304	VaLvczhal.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2496	3056	IesVpn-winx64.exe	31
PID 3056 wrote to memory of 2496	3056	IesVpn-winx64.exe	31
PID 3056 wrote to memory of 2496	3056	IesVpn-winx64.exe	31
PID 3056 wrote to memory of 2496	3056	IesVpn-winx64.exe	31
PID 3056 wrote to memory of 2496	3056	IesVpn-winx64.exe	31
PID 3056 wrote to memory of 2496	3056	IesVpn-winx64.exe	31
PID 3056 wrote to memory of 2496	3056	IesVpn-winx64.exe	31
PID 2496 wrote to memory of 1164	2496	IesVpn-winx64.tmp	33
PID 2496 wrote to memory of 1164	2496	IesVpn-winx64.tmp	33
PID 2496 wrote to memory of 1164	2496	IesVpn-winx64.tmp	33
PID 2496 wrote to memory of 1164	2496	IesVpn-winx64.tmp	33
PID 1164 wrote to memory of 2432	1164	updervn.exe	35
PID 1164 wrote to memory of 2432	1164	updervn.exe	35
PID 1164 wrote to memory of 2432	1164	updervn.exe	35
PID 2208 wrote to memory of 1480	2208	cmd.exe	37
PID 2208 wrote to memory of 1480	2208	cmd.exe	37
PID 2208 wrote to memory of 1480	2208	cmd.exe	37
PID 1480 wrote to memory of 2272	1480	VaLvczhal.exe	39
PID 1480 wrote to memory of 2272	1480	VaLvczhal.exe	39
PID 1480 wrote to memory of 2272	1480	VaLvczhal.exe	39
PID 2856 wrote to memory of 1304	2856	VaLvczhal.exe	40
PID 2856 wrote to memory of 1304	2856	VaLvczhal.exe	40
PID 2856 wrote to memory of 1304	2856	VaLvczhal.exe	40
PID 2416 wrote to memory of 644	2416	LetsPRO.exe	44
PID 2416 wrote to memory of 644	2416	LetsPRO.exe	44
PID 2416 wrote to memory of 644	2416	LetsPRO.exe	44
PID 2416 wrote to memory of 644	2416	LetsPRO.exe	44
PID 644 wrote to memory of 2240	644	cmd.exe	46
PID 644 wrote to memory of 2240	644	cmd.exe	46
PID 644 wrote to memory of 2240	644	cmd.exe	46
PID 644 wrote to memory of 2240	644	cmd.exe	46
PID 1980 wrote to memory of 928	1980	DrvInst.exe	48
PID 1980 wrote to memory of 928	1980	DrvInst.exe	48
PID 1980 wrote to memory of 928	1980	DrvInst.exe	48
PID 2416 wrote to memory of 2892	2416	LetsPRO.exe	55
PID 2416 wrote to memory of 2892	2416	LetsPRO.exe	55
PID 2416 wrote to memory of 2892	2416	LetsPRO.exe	55
PID 2416 wrote to memory of 2892	2416	LetsPRO.exe	55
PID 2892 wrote to memory of 2332	2892	cmd.exe	57
PID 2892 wrote to memory of 2332	2892	cmd.exe	57
PID 2892 wrote to memory of 2332	2892	cmd.exe	57
PID 2892 wrote to memory of 2332	2892	cmd.exe	57
PID 2416 wrote to memory of 1008	2416	LetsPRO.exe	58
PID 2416 wrote to memory of 1008	2416	LetsPRO.exe	58
PID 2416 wrote to memory of 1008	2416	LetsPRO.exe	58
PID 2416 wrote to memory of 1008	2416	LetsPRO.exe	58
PID 1008 wrote to memory of 2888	1008	cmd.exe	60
PID 1008 wrote to memory of 2888	1008	cmd.exe	60
PID 1008 wrote to memory of 2888	1008	cmd.exe	60
PID 1008 wrote to memory of 2888	1008	cmd.exe	60
PID 2416 wrote to memory of 2448	2416	LetsPRO.exe	61
PID 2416 wrote to memory of 2448	2416	LetsPRO.exe	61
PID 2416 wrote to memory of 2448	2416	LetsPRO.exe	61
PID 2416 wrote to memory of 2448	2416	LetsPRO.exe	61
PID 2448 wrote to memory of 1548	2448	cmd.exe	63
PID 2448 wrote to memory of 1548	2448	cmd.exe	63
PID 2448 wrote to memory of 1548	2448	cmd.exe	63
PID 2448 wrote to memory of 1548	2448	cmd.exe	63
PID 2416 wrote to memory of 600	2416	LetsPRO.exe	64
PID 2416 wrote to memory of 600	2416	LetsPRO.exe	64
PID 2416 wrote to memory of 600	2416	LetsPRO.exe	64
PID 2416 wrote to memory of 600	2416	LetsPRO.exe	64
PID 600 wrote to memory of 1644	600	cmd.exe	66
PID 600 wrote to memory of 1644	600	cmd.exe	66

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\IesVpn-winx64.exe
"C:\Users\Admin\AppData\Local\Temp\IesVpn-winx64.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\is-DNFNA.tmp\IesVpn-winx64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DNFNA.tmp\IesVpn-winx64.tmp" /SL5="$3014E,36942677,735744,C:\Users\Admin\AppData\Local\Temp\IesVpn-winx64.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Users\Admin\AppData\Local\Programs\LetVProtecter\updervn.exe
    "C:\Users\Admin\AppData\Local\Programs\LetVProtecter\updervn.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Users\Admin\AppData\Local\Programs\LetVProtecter\VaLvczhal.exe
      "C:\Users\Admin\AppData\Local\Programs\LetVProtecter\VaLvczhal.exe" 41265C0AAD964DDC431C9 1164 C:\Users\Admin\AppData\Local\Programs\LetVProtecter\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2432

C:\Windows\system32\cmd.exe
cmd /c start "" "C:\Users\Admin\AppData\Local\Programs\LetVProtecter\VaLvczhal.exe" "682de61d43cc5c649c5c" 2432 "C:\Users\Admin\AppData\Local\Programs\LetVProtecter\"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Programs\LetVProtecter\VaLvczhal.exe
  "C:\Users\Admin\AppData\Local\Programs\LetVProtecter\VaLvczhal.exe" "682de61d43cc5c649c5c" 2432 "C:\Users\Admin\AppData\Local\Programs\LetVProtecter\"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\VaLvczhal\VaLvczhal.exe
    C:\Windows\VaLvczhal\VaLvczhal.exe e4a4d38bf71981a8081 2432 "C:\Users\Admin\AppData\Local\Programs\LetVProtecter\"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2272

C:\Windows\VaLvczhal\VaLvczhal.exe
"C:\Windows\VaLvczhal\VaLvczhal.exe" "84b87070105a684e7"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\VaLvczhal\VaLvczhal.exe
  "C:\Windows\VaLvczhal\VaLvczhal.exe" "cb1c9878ef15f86e4c"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1304

C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\LetsPRO.exe
"C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\LetsPRO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ""C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\driver\tapinstall.exe" install "C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\driver\oemVista.inf" tap0901"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\driver\tapinstall.exe
    "C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\driver\tapinstall.exe" install "C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\driver\oemVista.inf" tap0901
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C netsh interface ipv4 set interface LetsTAP metric=1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\netsh.exe
    netsh interface ipv4 set interface LetsTAP metric=1
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C ipconfig /all
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C route print
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\ROUTE.EXE
    route print
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /C arp -a
  2⤵
  - Network Service Discovery
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:600
- - C:\Windows\SysWOW64\ARP.EXE
    arp -a
    3⤵
    - Network Service Discovery
    - System Location Discovery: System Language Discovery
    PID:1644
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2536

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{79070f06-9c6b-609c-288d-55581bcba775}\oemvista.inf" "9" "6d14a44ff" "00000000000005CC" "WinSta0\Default" "00000000000005A4" "208" "c:\users\admin\appdata\local\programs\letvprotecter\letsvpn\driver"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{4a2335d7-f8bf-5f4f-91ea-0a2d544ab70d} Global\{4e24fcf1-c5da-091c-379a-2f50c525d066} C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{28db2ba5-209b-4a3d-b6e8-013b1c688468}\tap0901.cat
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:928

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2632

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000604" "0000000000000600"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:tap0901.NTamd64:tap0901.ndi:9.24.6.601:tap0901" "6d14a44ff" "00000000000005CC" "00000000000005F8" "0000000000000600"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
186a1cf785cc384d0c35bcc2e81c2c05

SHA1
0cdcc4ffa3f098ddd73f6634cac60e4713f4244b

SHA256
6e29a610b64f04f24de71e39f3dc396f53fa6c50673966c79a8291eb1f4e07d3

SHA512
06d458ca140b786e35e9d60d31a9ce5bb04a51b7e66780f9fd313c3d529a5ea1676e51ad4424250f2a1c336a2fe66475ae37ce8e3a48f3b3856641793a7a50a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3df241819500c5c39fae1974d3cc9c33

SHA1
f5f9deefe90bd29aad5c5d61bad70477f16746f9

SHA256
54734d4ce5ff27074a1189ea97cbf0fa23e3ce52e67fbb2d27b72b41124bb0ea

SHA512
00c6e8b7920ff6f7f7ca7682068f3c094a79223d516cbf06c91ca888803e08eb4385652cca47b0c8ebd00dce1c75496e4d6281f4f5813e8dda49bdec1edc5fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed7357186b88679f22756c70c2933fd8

SHA1
f4dacc59f51351f2b068aeff801f1d18aab46a98

SHA256
985ae7b81c1faac96caadfef9c7b154ab0206632ff2ac0619a8cb82e57ba1e4c

SHA512
b854035f7f27962c63810e53562f6f6a57e4e99c66811cfc77aa941b970dbc426304018466fa5e5a2c0de1a278b426bb4d2a6e867b8e76b29f2ee73e3d38b756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0f5d22e490931b771ed2c5a8c4031ba

SHA1
2903264d0689a30ec97c3cc37540dd4ff5fd0b27

SHA256
150e991417cc68546e3017acaa12e60b3c92847c304e14c038009b890b1c0237

SHA512
43dcea0fc81c9b5140c70bd824df59c3251b09581ce355b420e68d73e7448beec7c01ea2647b7f444fb4c5b18d19eed233561fe69efaa025dbe70238386c3556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8e2799ee95f963dacddb0af08cf5cd0

SHA1
c6246a5a10723442bb683f6336e9c77ff26ab71f

SHA256
cd081205d2c0a24c2d50f91ff12f644d803adddcdad6df627a49176dc2f410a7

SHA512
ba50df09495368eedc39da9e28830e0eb7b5ef7bd339cc0e7b4851ffd0f1284f21ba5bad6557674e3535813821e3da6d5a1d9a4ef7e2fafe6d78f493197a1b8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17dc450013a8e8a8aab6e93e9d45a9d5

SHA1
dc8c6aa923cb874bc00fc90bcbf6e6a428635c55

SHA256
23671573a78f43e11aac4767c0d3daa45aff3fc547b124de96ad3c51599a343d

SHA512
13c51475fc366c9f13be66bc8a33a5372fe2f7247c7f6e5ebdb7dba6af1bfbef8f98a6de3674b2c3bddf8b523ca6557af1d858255825c28d6b91a2b16a255c6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88d252b8e050735d77f6936fb1ff36a8

SHA1
46bcce6154f217304da5f4c612576485ce161688

SHA256
ce66edc36ba0b3c2f9977e84a7bb049514316bbd0b2142aeeb5b68f0b9ddd2c0

SHA512
a3e7c75906d826fb2f1aaf1a034a3b24dd2a6257514a916dd1deaadaa104f3af3ff20462652748f98831eeff651f247fe2fa31546a6426c383192f8126168c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd81b40f1cb88590739822d9de71e66b

SHA1
29c135241c366e2844e6604289dd3b8cb6e6f274

SHA256
a8fd392a3ada7c77e30217302d6061c1bf75e187cb756c27a4ed8eb4914e1839

SHA512
0f355f0d2f021d9735311a4b3504b96b0dbf6e9fad7223818a0cc63ee075b4572043d406a21cb654b8bbd46807fdd48a6dc32c776b8b5c6bdc02a487a23110fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e65d99187e9f6cb495e022ead5097a8a

SHA1
3285f16bb1c9ea56523d20263bb47b0e5d71f513

SHA256
d62f777734897ef8bf19cd7995680f77c25b85dcbb3cfb09dc7ecef2db2e90f7

SHA512
cd9771bae5f0c78354ed80a4b249662bf398d21dbe20059a34dbfa531439766d375173a59e2e71dcdc12efecfff9c05aff0ae05e0d58d87d3e54b35bcfd45700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
34b94781b65abc71f5801a8735c5e5de

SHA1
e1c1d30b8ed4b07efa671132c2bd572929629d7b

SHA256
e7d6464e7cb8d246e5f9fb8b012fd97819c83c58928103d116f42e9ef8366c39

SHA512
729ce7706d184c0ac7909b79c7509e64444faf3b626a5c694cd65874adc52d5176de8405de4da5aee36ece93b066a13f8de1983ee4b0418e0efb0ca7f6bcba76

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\LetsPRO.exe

Filesize
1.4MB

MD5
71f9f9c8a27965572a7ea9c8055232c1

SHA1
36748c1df3992eb5677c33b08f2ca56d901bb4cb

SHA256
eb3d30d96a5a2dedb003f2c3192b9d8d60a895b0c1f2c230e2a5498f711428b4

SHA512
28d12e00e46c7cc9c65b72d80cab58d4f0fcfdfa5037404081898ca94d71c1c7152cbb2ef6e36cab77f03f6a7a22478e91f892030e72799ab816edd0cb37fc30

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\LetsPRO.exe.config

Filesize
22KB

MD5
ebaeca4375f9cc819ff3835ba62717de

SHA1
819d4ad83729d709a3ed6172e2c608af70de3d03

SHA256
a12e73eb35a51a227afd1318edb824a77cbe60d2fbf67e1463404c0673e42d9c

SHA512
311d6aa1a8608b327bfa97cb77e4e21a44946438f60c6c2fc9e0bf9ef97434138d0136ca1d55c7d836d72a03cebec63beefd974219ab8ea580eddf3e23e76d3f

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\LetsVPNDomainModel.dll

Filesize
21KB

MD5
b8ab11073f53a6312529489434f76db9

SHA1
26d497e6bc5227f193acfd9d3d4987c1326514e7

SHA256
7171bc86ad77ad2abceaa61f199d3958f6864450868ab9ae3acce381dce1c0bb

SHA512
05c734c3f5b660bdc37e2ad24201be4377a21d86be9d3f4aed2411eae4113f9c9ffa0fec43a79453b166af9e5e8e041c69019ed9f10c30fb8e295286321d3c90

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\libwin.dll

Filesize
10.2MB

MD5
31dc3b6908dc8064a57d4ac304eadd15

SHA1
5cb8d2a8efc7d286e235f92d3c84478fa7e21e6b

SHA256
dd20e8ac57d70710e1d51159fec47ef626a133f1a57fd0e721a0706c1a1af11e

SHA512
fe82c1a8517cc13d25714ef1eb347291360681ec69c2e0b79a826a16bbe58518dea12f63848f3c72c7499c046c0043d9cb9d2dfbd04ebf1622a136ceb589ef0f

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\log4net.config

Filesize
3KB

MD5
28f9077c304d8c626554818a5b5f3b3a

SHA1
a01f735fe348383795d61aadd6aab0cc3a9db190

SHA256
746b5675ea85c21ef4fcc05e072383a7f83c5fe06aaa391fc3046f34b9817c90

SHA512
485c175bc13c64601b15243daecbf72621883c2ff294852c9bbb2681937f7ef0bea65361e0f83131ec989432326442ef387c1ccf2a7ca537c6788b8fd5c0021e

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\p-try\is-G2NPT.tmp

Filesize
1KB

MD5
915042b5df33c31a6db2b37eadaa00e3

SHA1
5aaf48196ddd4d007a3067aa7f30303ca8e4b29c

SHA256
48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0

SHA512
9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\pump\is-RBB63.tmp

Filesize
1KB

MD5
9befe7026bf915886cd566a98117c80e

SHA1
a95ab3a4b0e4bd978897f09b3b430a449da20a08

SHA256
3fe8d55a98dbf260eace67c00cf9bc53edb46234e840098a0b93df3096b97fb6

SHA512
b52ba143042812d6dd1031a12946afddb6e8f8ebbc7169c59c138d16aafc5e261aae92fe6b1ea94a3d80e39d2415c4b219710ef46939a2df135db24a0cf712fb

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\puppeteer-core\lib\cjs\puppeteer\api\is-S7JDU.tmp

Filesize
10KB

MD5
4cccc7dd6d41548966764d4b150ebaf9

SHA1
9b12c67074a1146b3f9cb71578b6449d6c769333

SHA256
95ed23f5e0e9c970b2908928df8264087d11e31ea72663c32066a7cda4341261

SHA512
2285b88b12bfad1d36899d002f2999b88492571fc5d1c0631739908d39c5bdb4ebdf405d92b9aef26c1fa509e866e310bd6fffb1f00905e08eb57c0855de4edc

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\puppeteer-core\lib\esm\puppeteer\api\is-ISDV6.tmp

Filesize
10KB

MD5
b3e85b60aa95528064a86c2bc3ccfbe1

SHA1
08af560d4568f7bd84e0a1878a580f6e77b42c58

SHA256
9fd1a2950ef3d1ae288a2349e2a4dc6bdfea7590e9f649c75763cd63552420b7

SHA512
cd495c838c0df68a2bd70ea68b8ba8c15c4d990cea96a51c964e63c949b14c0a5e2e72bb64f7b16006f968119e1af01433e44cc8b68aa22f3c7ee7d0cad92745

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\quasar\dist\api\is-ALE23.tmp

Filesize
586B

MD5
f937506e30efadf9cad7de0f2e8b6ef4

SHA1
d329734bcca0d55faaeeb3d6ec7d18f21ec17ecf

SHA256
373ab4932e9b7e5e21492c2d79c807815a6cd3c8d3bb06d3a8228fbdca47ba83

SHA512
ca466f1bbf9ab876bc106ab726df8bad24fa800612ffb30c681973ab60a4883c51a196dae16b7fc1ee80b43b8532b9f2d768ca983f839ac0ba6d1874902fe633

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\quasar\src\components\spinner\is-CFJTP.tmp

Filesize
57B

MD5
61a3de250bc0e73b428fef7bbc9a4a79

SHA1
2167d7ccd1d82320f05695981b19e3d2e2f6d627

SHA256
e1645da3725b5fc270935853235d7ab489b135f6ce1f71e6f577c1d1f30ab9de

SHA512
ea9499b4d33e9136c0d1540a878bf0c18513a84d4be14eac02f5d1591bfb002b8cd6af332bcaf2da58943da2d79a1a3c42f93a87baa800b7dca815c6b968bfb6

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\stream-http\node_modules\readable-stream\is-5M22P.tmp

Filesize
1KB

MD5
08365b138b43284489ecfbf6efd44a25

SHA1
1b97e91ac67fcbbd711dedd3b5c388c08489eeaa

SHA256
56e4e12a6934a2c4d36c7bf893f4d8aefa6c96f9ffcec357dfa6476e36c4f1f5

SHA512
85494ca6582db6aa3679f532c540f2075516628c02abd6fc827369cf8ec1f2ac66092ff815406d4670c7a33cadc62f34c2c478136953656ce85a7d5755f8c31e

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\stream-http\node_modules\readable-stream\is-H8LU2.tmp

Filesize
2KB

MD5
a67a7926e54316d90c14f74f71080977

SHA1
d3622fac093fe1cbcb4d8e8d35801600b681fc45

SHA256
ec62dc96da0099b87f4511736c87309335527fb7031639493e06c95728dc8c54

SHA512
e61de704d5a76afd66b5d9b1c78f0a5afe9a846686ca2fb28c814a4a60dbe82a190ed4a6a2f31e09bf6d695b8ec178ebea9804593029c58c1b1bedd793324d13

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\stream-http\node_modules\readable-stream\is-PMQ0H.tmp

Filesize
5KB

MD5
70b44945cec4643ca805d87f673fbd34

SHA1
f30fd9ba0fa4f12c900d1b7bb248aa568a72cc3c

SHA256
7a521e462d1c6f3b599c44637fb337bbf969dda311510a87236ec539a415331d

SHA512
586f0f2a46ae29e8dc0b5931e144d3b7536057cb0a6d2ecfc72544c5048a1fc9417d14fbdb45f33e21eef99a2a0e302a3c74d2f8e360573544c8328593053daa

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\stream-http\node_modules\readable-stream\lib\internal\streams\is-E179N.tmp

Filesize
36B

MD5
76bae0aaca4d9c61a71995751b67448b

SHA1
90b89ec87417d1301e7615a3ba50b04626c2796c

SHA256
1e7903927df33aadb3659ecce55266c9c851da65ce6c8b723a60a305c1c5422c

SHA512
9be70625af9c47a3772622031cdc4ada6e009d9ddf71f7409109ef6b6adfb444414630897eab07f77bd268f66c9462d199cb72934e0bb4fdbbe614f16bb3de24

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\stream-http\node_modules\readable-stream\lib\internal\streams\is-V1PF7.tmp

Filesize
49B

MD5
df20453c19af8406babdf987facd76d9

SHA1
0167a0dc72daab83989846563aae870f37549151

SHA256
72d46a15491627d8fb1489a47d03583cfe5c21902918016ab532b53e615e5a9a

SHA512
8004aca5efc10cf89bf41ecbb6586f9acd707ef3b789cc714043c48c0d47b6479d9d2c2fd9894aedc683edcb88fad8b28517d329417d6e2d0e2b639d964956d9

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\stream-http\node_modules\safe-buffer\is-LJ1T5.tmp

Filesize
1KB

MD5
badd5e91c737e7ffdf10b40c1f907761

SHA1
07d9563f6153658de124707787ff43f0458ab24a

SHA256
c7cc929b57080f4b9d0c6cf57669f0463fc5b39906344dfc8d3bc43426b30eac

SHA512
ef233f8db609b7025e2e027355ee0b5e7b65b537506412ca1a4d95e74f2be2fe284c3a3fa36cb9d85dbd1a35fe650fe14de5b4d93ab071f2024c1fc8cf40730e

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\string_decoder\is-J7Q9G.tmp

Filesize
2KB

MD5
14af51f8c0a6c6e400b53e18c6e5f85c

SHA1
36791ee8e28518f9fb92b51ad9e4247708be9c55

SHA256
11f2aafb37d06b3ee5bdaf06e9811141d0da05263c316f3d627f45c20d43261b

SHA512
a7ffef419c24a9420ce268a6f3c7cca136bb47d2a33da37d08bd5ea213a3f58e9e28375ed3bb457ecf7c0c1b3f1434366da4e8bef219482fcf599d804575e5fb

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\string_decoder\lib\is-EDAEE.tmp

Filesize
9KB

MD5
0d4d70ba095a2af4afd7069a295d2f6c

SHA1
440bd1828612d1e583e33a4ec304673a11c782af

SHA256
f1d36d47b2c579063392c1a68963467f2d4f51a069af09eb068d974c63ee3b37

SHA512
f527fcaa28387a43a4df21c3c2e43e001b036a179383a61c58e194a33f67ac3ce445ef692d21e8f79139374f4a0749d1cebd2cdb59a4d9b4d2ec71bffd8b3be2

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\string_decoder\node_modules\safe-buffer\is-7MHO4.tmp

Filesize
1KB

MD5
b1622ff2944ba3f13a1cf6fbcf0f9e3f

SHA1
f67b8decb99eed068f28c9ae56df08c21bf4c33d

SHA256
d58af21cb0518864d0c505742d1af71e5b5e1f142f4c0f27353aa0f431a616d4

SHA512
600b49f49832ee51ffd8f6c99616387d93bb1fc2afee71d2066f982e39080a1508999ef2e2bf714d5f6adabaa8b72d3c5cdb445c8c36b67064dd76b377b7f889

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\string_decoder\node_modules\safe-buffer\is-JPLLG.tmp

Filesize
500B

MD5
b55e2fba27745164c9cdb610293d470b

SHA1
bdf56f6d8cd14a6791c3a42f48e61d0a8ff660e8

SHA256
0bb53dcf379ffebc8f8baa2d2a4efc80be25f203509da73cc17864b97cb9556e

SHA512
22150dd9b47bf3f92f2417ad484d696c4567d95f35ea47ec61a710b1a10567df504358892f8b1e3fa7930d3c4424c09f90a84b2cb991fc5d3e33228ea50e1766

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\tar-stream\is-VOFE4.tmp

Filesize
72B

MD5
ee0590371028f8289cb74effdfb3d25e

SHA1
02d80878508b3687b56cc181c3953e596da53521

SHA256
0db9eceef5224dbc34c224c398b50eef4b99f937c80c81f660928615a248ed4f

SHA512
957c8510abeb083a1c69e4a13965be70699d10c11b37d00f6951d2be73c5eeb15df8355280e51e7bfff49e969acded8e8bb8c0f2fad8e57dae7535087afdf487

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\urllib\node_modules\lru-cache\is-5AABU.tmp

Filesize
765B

MD5
82703a69f6d7411dde679954c2fd9dca

SHA1
bb408e929caeb1731945b2ba54bc337edb87cc66

SHA256
4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b

SHA512
3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\urllib\node_modules\socks-proxy-agent\node_modules\ms\is-L4I1O.tmp

Filesize
1KB

MD5
fd56fd5f1860961dfa92d313167c37a6

SHA1
884e84ebfddafd93b5bb814df076d2ebd1757ba8

SHA256
6652830c2607c722b66f1b57de15877ab8fc5dca406cc5b335afeb365d0f32c1

SHA512
2bec1efb4dc59fa436c38a1b45b3dbd54a368460bcbbb3d9791b65275b5dc3c71a4c54be458f4c74761dccb8897efaab46df5a407723da5c48f3db02d555d5b9

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\win-release\is-HOH2S.tmp

Filesize
1KB

MD5
a12ebca0510a773644101a99a867d210

SHA1
0c94f137f6e0536db8cb2622a9dc84253b91b90c

SHA256
6fb9754611c20f6649f68805e8c990e83261f29316e29de9e6cedae607b8634c

SHA512
ae79e7a4209a451aef6b78f7b0b88170e7a22335126ac345522bf4eafe0818da5865aae1507c5dc0224ef854548c721df9a84371822f36d50cbcd97fa946eee9

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\node_modules\yargs-parser\is-JQNTD.tmp

Filesize
731B

MD5
8fd106383180f7bbb8f534414fdf7d35

SHA1
47edc4b4e929248ad6e423bf3a6736c320a3277c

SHA256
365496ca1f56da40b23c9815fc40fa9005847b2f8f8fd1c1a4929ef25ec8cd1d

SHA512
113a0fb1a7939f59bf84a29a58e349870aa3bc85afadae428d631ac7ec8258bac8375fe31522f03e484debc562430603baeb7d28256719140a26ec5aca7e9104

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\support_report.inf

Filesize
10.6MB

MD5
b6188441b4a3c8447714a8c58b857e98

SHA1
94ec53d8473c3280c198eed210befdf901832a95

SHA256
72533edc34513092a6e73760647be67257a895e2c65876e8d03120dec1dfaf0c

SHA512
b9ae3af40d873eeea0dbf6f380e3fb8e622e13ada4e31c9d39fc2c53e1138ee790fe93c1483364ffd61551da9da4d8f60ffabb0731e916b270efe01c095975c1

Download Submit
C:\Users\Admin\AppData\Local\Programs\LetVProtecter\zlibai.dll

Filesize
9.6MB

MD5
45559ce094bc20305befef71b7f78535

SHA1
720b296a933ec0515c112bf475b72ff149fcf2a9

SHA256
b2d478df34d91bed5cd8caddbb79ce4678f300d4cff094bf3c5b4dcd03379912

SHA512
b9b7ff2a19d5e0a36425cd245d987f7e43cd1f7d3fe082a69dc4488c6b406e875daa662a324d0649040fb4b3e75d596ac8ac190d73c4dc7320a799dc9ad74b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA6E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{79070f06-9c6b-609c-288d-55581bcba775}\oemvista.inf

Filesize
7KB

MD5
26009f092ba352c1a64322268b47e0e3

SHA1
e1b2220cd8dcaef6f7411a527705bd90a5922099

SHA256
150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

SHA512
c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

Download Submit
C:\Users\Admin\AppData\Local\Temp\{79070f06-9c6b-609c-288d-55581bcba775}\tap0901.cat

Filesize
10KB

MD5
f73ac62e8df97faf3fc8d83e7f71bf3f

SHA1
619a6e8f7a9803a4c71f73060649903606beaf4e

SHA256
cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

SHA512
f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\{79070f06-9c6b-609c-288d-55581bcba775}\tap0901.sys

Filesize
38KB

MD5
c10ccdec5d7af458e726a51bb3cdc732

SHA1
0553aab8c2106abb4120353360d747b0a2b4c94f

SHA256
589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

SHA512
7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

Download Submit
C:\Windows\inf\oem2.PNF

Filesize
8KB

MD5
f41e42e740c314f4436ee6ac84ca06b2

SHA1
26eb0a9a7b62efc83f30817f018c0762bf92ecac

SHA256
9a321fe93f5d5c6a04b86720d9362b51da884c1d1cc7812381ee9ebc244a6a66

SHA512
942580e250a45554b190f712646ac8f9b55102a01f42e2e4c084a9b84de0f08ed7e7e877095c196603b9a425ddcd270a7173c0f6f10e4672f57f8f7c78f77f00

Download Submit
\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\CommunityToolkit.Mvvm.dll

Filesize
109KB

MD5
dfe09bc93d85a91f424c6401e33051b6

SHA1
c30ef46ceef3f3b3135d58da4925d1aea38b3203

SHA256
9214df29fcefe144f2ecf908cf9f2169e49e91fa56b1ec3223a4b184ff5f612c

SHA512
b05b756b3b63455d870c03790178c2c6f7234cd4b25f6dedf47f249fd2a30a844a031af97e2d22f37a5999981614a3ef0e0d8748a05448987d72073c86afeb48

Download Submit
\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\LetsVPNInfraStructure.dll

Filesize
23KB

MD5
ae5033063d375120c813fe2a49820727

SHA1
d23641a2909b60db763952435c54efa8f6bd4db7

SHA256
a081ed96055cbb0082b1c15bf092c4888cff3a1f76bc56746c7913667fdf9822

SHA512
b00720240aa6961b628d016dc4e60d58182f42831f1e2a9707f85f300e11ea1263e34f2048246dcba392146ff014ae300cb307eba0052edd8fb752d9b9fc8896

Download Submit
\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\Newtonsoft.Json.dll

Filesize
693KB

MD5
44bf96b5782fb6c3723189464ce376a9

SHA1
d78d67bace31a428b38125d313a42fa9f6e6a0bf

SHA256
d738252b00f38b0d9421a5c7b4195b65710eac996df1efc4877664735d7b2ace

SHA512
36058bf73de1da1a81bb1eb15dc2b847a0172595fa3de23edfe3b96275ce6ede5fbc8987640af4b8179d93c7964491aeef8ba42993fcab260b753bed0177b27f

Download Submit
\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\System.Buffers.dll

Filesize
21KB

MD5
77bb70791e61ac8edd227a9ffb34ce34

SHA1
966cf5c7c5be06c11eb7cef8d40250d3f8fe498b

SHA256
2299c772cd3676f79568d4d94c7b9a4ac8b60a5c98b84568d714a6cc77a91315

SHA512
f6ef04cdbe8a27c994ca39b506a4b3b84144f2af0637d70ff7db4c79bd06c183bb3719cfb61c1f669fe2183eb49706e19ce214f205384022822f26c74e86fc17

Download Submit
\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\System.Memory.dll

Filesize
138KB

MD5
fb29c7f3049f3ac34e92699ba264fc5b

SHA1
b2b39d86a2aac4043c3a734b87ec59e8cc4abe70

SHA256
b482c6937515c7e19c97ac653475c138f01ed2475478690230b4ac3ab8cd0984

SHA512
f2adb1ae1878bb72afb000a67876fbfbf068c067ebc8a7156d274390ed7ea90d659a4918eac3ae53c78d3552905ac8e4077b95447ad246e71872bb2cea76558f

Download Submit
\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\System.Runtime.CompilerServices.Unsafe.dll

Filesize
18KB

MD5
311207903ae3b461eeaf73c1e1ce7470

SHA1
7ef8daac87248f0bc144c3334496ebd2dc89aafe

SHA256
73ab48609cde990826dcb9ac54b0f439a98dc7dbf3021e527903d010565f8c21

SHA512
8bd9bc218663aa85aba0d9097ae969a73923cf185d6446654be42111c4b32472e403f123c462bd5f4fa38a2ed8094996c7a523441499f4e3344b16fe935afcee

Download Submit
\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\System.Runtime.InteropServices.RuntimeInformation.dll

Filesize
21KB

MD5
11f1dec2f83f2e832e56a0e32f83feaa

SHA1
27ec65236be02507ad70708333fe503adb07cabe

SHA256
a4e2e16ad23e6874783ca18d42bd119b7a18e77b6ca66374d5b62f961e83c83b

SHA512
35d8435d25478613081cb165bf566a2b2071efdac4309ac0be367681882f0aaa019240a15285d959a44f09ebedac64a63fb70e09dd3007c81675cab889005a78

Download Submit
\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\Utils.dll

Filesize
126KB

MD5
d144ac9b53c174ae896d54a5ce7ad9af

SHA1
62be56006381323045af6d2bc4cf28445fcf18d5

SHA256
7569d9dde7ff3efc6c82c797e44aa67cdf8e055476c873b192675a38fbd903e9

SHA512
b26f278340440ef2cd2dad53e3e6eac5a78c49e2c8bd2af52539824d14d626f264442d5f587859b288bf0e1de26033319bfca43ac52f195ab7bfd2bc6f8e411a

Download Submit
\Users\Admin\AppData\Local\Programs\LetVProtecter\letsvpn\app-3.9.0\log4net.dll

Filesize
273KB

MD5
dc4917fb4953fb82ac01305a18605cd7

SHA1
80ae67800377253afe571f8af59b476264edcca6

SHA256
453b9086a5aab3deb2513de2dd5b21216eb3a9bf2f2c81393891b93e7e5e0fc4

SHA512
d97223d256bf3ce30a504ab986564dff31f498c80d1815b4f8454f6ae8d0c55c9054fde7b80b85df4276fc08e3a1ae2b682960912984eaa1299c8b22308db120

Download Submit
\Users\Admin\AppData\Local\Programs\LetVProtecter\updervn.exe

Filesize
5.8MB

MD5
66b93370d7a832f889acc395e3ec16c2

SHA1
1126912895968dbbb38a7e729f206b6c9aed346b

SHA256
f8d41f0b9c9764a826e0d40b3926ea8be2f3c551b0de9594e227e8681bcb0a69

SHA512
03684cac3fe5390d1a67e3cddf61789b9eb4e629987c9a6fff9b1d058f53a665184fc48b18713148bc11401e0c3f47c274a6700582745c57b23b0c8aada7cee1

Download Submit
\Users\Admin\AppData\Local\Temp\is-DNFNA.tmp\IesVpn-winx64.tmp

Filesize
2.9MB

MD5
b217b316699ff55e3f4a7cc97684e82c

SHA1
40bfd6fa9a558dbb52bc009d8dd933ac69bf1e2c

SHA256
68ac0e3a979eb3bb0350e50f779d9fbdcf619261fb3e31141dc946b5d5820531

SHA512
08164aed9743927d38e89f8dd00f4aa7be78f99c3ca687b334ba4c85bc7c029f5893a90329db02b292cc6d9b5b2eb682ad64d91dab3f93bed1767534bae4d46a

Download Submit
memory/1164-7620-0x000007FEF24C0000-0x000007FEF589D000-memory.dmp

Filesize
51.9MB

Download
memory/1164-7638-0x000007FEF24C0000-0x000007FEF589D000-memory.dmp

Filesize
51.9MB

Download
memory/1164-7631-0x0000000005F60000-0x0000000007D60000-memory.dmp

Filesize
30.0MB

Download
memory/1164-7632-0x00000000092E0000-0x000000000A48A000-memory.dmp

Filesize
17.7MB

Download
memory/1164-7633-0x00000000092E0000-0x000000000A48A000-memory.dmp

Filesize
17.7MB

Download
memory/1164-7619-0x000007FEF24C0000-0x000007FEF589D000-memory.dmp

Filesize
51.9MB

Download
memory/1164-7621-0x000007FEF24C0000-0x000007FEF589D000-memory.dmp

Filesize
51.9MB

Download
memory/1304-7699-0x0000000001CE0000-0x0000000001D04000-memory.dmp

Filesize
144KB

Download
memory/1304-7685-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/1304-7695-0x0000000006ED0000-0x000000000807A000-memory.dmp

Filesize
17.7MB

Download
memory/1304-7707-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/1304-7698-0x0000000001CE0000-0x0000000001D04000-memory.dmp

Filesize
144KB

Download
memory/1304-7700-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/1304-7701-0x0000000001CE0000-0x0000000001D04000-memory.dmp

Filesize
144KB

Download
memory/1304-7702-0x0000000003290000-0x00000000032DA000-memory.dmp

Filesize
296KB

Download
memory/1304-7686-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/1304-7696-0x0000000001CE0000-0x0000000001D04000-memory.dmp

Filesize
144KB

Download
memory/1304-7729-0x0000000001CE0000-0x0000000001D04000-memory.dmp

Filesize
144KB

Download
memory/1304-7691-0x0000000006ED0000-0x000000000807A000-memory.dmp

Filesize
17.7MB

Download
memory/1304-7693-0x0000000006ED0000-0x000000000807A000-memory.dmp

Filesize
17.7MB

Download
memory/1480-7682-0x000007FEF24C0000-0x000007FEF589D000-memory.dmp

Filesize
51.9MB

Download
memory/1480-7657-0x00000000059A0000-0x0000000006B4A000-memory.dmp

Filesize
17.7MB

Download
memory/1480-7655-0x00000000059A0000-0x0000000006B4A000-memory.dmp

Filesize
17.7MB

Download
memory/1480-7653-0x000007FEF24C0000-0x000007FEF589D000-memory.dmp

Filesize
51.9MB

Download
memory/1480-7652-0x000007FEF24C0000-0x000007FEF589D000-memory.dmp

Filesize
51.9MB

Download
memory/2272-7690-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/2272-7687-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/2272-7689-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/2416-7943-0x000000002EEC0000-0x000000002EED0000-memory.dmp

Filesize
64KB

Download
memory/2416-7762-0x00000000056C0000-0x00000000056D0000-memory.dmp

Filesize
64KB

Download
memory/2416-7726-0x00000000055B0000-0x0000000005662000-memory.dmp

Filesize
712KB

Download
memory/2416-7738-0x0000000000E90000-0x0000000000EAA000-memory.dmp

Filesize
104KB

Download
memory/2416-7742-0x0000000000E40000-0x0000000000E4A000-memory.dmp

Filesize
40KB

Download
memory/2416-7721-0x00000000004F0000-0x00000000004FA000-memory.dmp

Filesize
40KB

Download
memory/2416-7715-0x0000000000A10000-0x0000000000A56000-memory.dmp

Filesize
280KB

Download
memory/2416-7754-0x0000000000FC0000-0x0000000000FCA000-memory.dmp

Filesize
40KB

Download
memory/2416-8123-0x000000002FB70000-0x000000002FB80000-memory.dmp

Filesize
64KB

Download
memory/2416-7750-0x0000000000DD0000-0x0000000000DD8000-memory.dmp

Filesize
32KB

Download
memory/2416-8122-0x0000000030D80000-0x0000000030DBA000-memory.dmp

Filesize
232KB

Download
memory/2416-7746-0x00000000049A0000-0x00000000049C6000-memory.dmp

Filesize
152KB

Download
memory/2416-7758-0x0000000001150000-0x000000000115A000-memory.dmp

Filesize
40KB

Download
memory/2416-8121-0x000000002F9D0000-0x000000002F9E0000-memory.dmp

Filesize
64KB

Download
memory/2416-8116-0x000000002F9B0000-0x000000002F9CE000-memory.dmp

Filesize
120KB

Download
memory/2416-7761-0x00000000058F0000-0x0000000005916000-memory.dmp

Filesize
152KB

Download
memory/2416-7760-0x00000000056A0000-0x00000000056AA000-memory.dmp

Filesize
40KB

Download
memory/2416-7949-0x00000000058B0000-0x00000000058E2000-memory.dmp

Filesize
200KB

Download
memory/2416-7711-0x0000000000470000-0x0000000000494000-memory.dmp

Filesize
144KB

Download
memory/2416-7706-0x0000000001160000-0x00000000012CE000-memory.dmp

Filesize
1.4MB

Download
memory/2416-8113-0x000000002FE70000-0x000000002FECC000-memory.dmp

Filesize
368KB

Download
memory/2416-7909-0x0000000006130000-0x0000000006138000-memory.dmp

Filesize
32KB

Download
memory/2416-7908-0x0000000006110000-0x0000000006124000-memory.dmp

Filesize
80KB

Download
memory/2416-7907-0x00000000060F0000-0x0000000006102000-memory.dmp

Filesize
72KB

Download
memory/2416-7906-0x0000000005FE0000-0x0000000005FE8000-memory.dmp

Filesize
32KB

Download
memory/2416-7910-0x000000000EA30000-0x000000000EA42000-memory.dmp

Filesize
72KB

Download
memory/2416-7737-0x0000000000E20000-0x0000000000E3E000-memory.dmp

Filesize
120KB

Download
memory/2416-7940-0x000000002EFF0000-0x000000002F006000-memory.dmp

Filesize
88KB

Download
memory/2416-7939-0x000000002EEB0000-0x000000002EEC0000-memory.dmp

Filesize
64KB

Download
memory/2432-7645-0x0000000006DD0000-0x0000000007F7A000-memory.dmp

Filesize
17.7MB

Download
memory/2432-7651-0x000007FEF24C0000-0x000007FEF589D000-memory.dmp

Filesize
51.9MB

Download
memory/2432-7641-0x000007FEF24C0000-0x000007FEF589D000-memory.dmp

Filesize
51.9MB

Download
memory/2432-7644-0x0000000006DD0000-0x0000000007F7A000-memory.dmp

Filesize
17.7MB

Download
memory/2432-7642-0x000007FEF24C0000-0x000007FEF589D000-memory.dmp

Filesize
51.9MB

Download
memory/2496-7625-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/2496-7613-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/2496-8-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/2496-12-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/2496-24-0x0000000000400000-0x00000000006F5000-memory.dmp

Filesize
3.0MB

Download
memory/2856-7703-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/2856-7671-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/2856-7674-0x00000000056D0000-0x000000000687A000-memory.dmp

Filesize
17.7MB

Download
memory/2856-7675-0x00000000056D0000-0x000000000687A000-memory.dmp

Filesize
17.7MB

Download
memory/2856-7670-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/2856-7697-0x000007FEEC030000-0x000007FEEF40D000-memory.dmp

Filesize
51.9MB

Download
memory/3056-0-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/3056-10-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/3056-7626-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/3056-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download