Overview

overview

8

Static

static

3

f80bc12ffe...51.exe

windows7-x64

8

f80bc12ffe...51.exe

windows10-2004-x64

8

kcinst.exe

windows7-x64

1

kcinst.exe

windows10-2004-x64

1

kcinst32.dll

windows7-x64

1

kcinst32.dll

windows10-2004-x64

1

letsvpn-latest.exe

windows7-x64

8

letsvpn-latest.exe

windows10-2004-x64

8

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

driver/tap0901.sys

windows10-2004-x64

1

driver/tapinstall.exe

windows7-x64

1

driver/tapinstall.exe

windows10-2004-x64

1

libCLI.dll

windows7-x64

1

libCLI.dll

windows10-2004-x64

1

msvcp140.dll

windows7-x64

1

msvcp140.dll

windows10-2004-x64

1

vcruntime140.dll

windows7-x64

1

vcruntime140.dll

windows10-2004-x64

1

vcruntime140_1.dll

windows7-x64

1

vcruntime140_1.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2024, 14:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f80bc12ffee2539f5827757dc8052decbbd795e604a58d8c83ae357cf5055151.exe

  • Size

    15.2MB

  • MD5

    23ac2dd53d9f44b721e72fa848ca6cbf

  • SHA1

    891ff5cc02e260c348daf8bb35ec80e28fc193f1

  • SHA256

    f80bc12ffee2539f5827757dc8052decbbd795e604a58d8c83ae357cf5055151

  • SHA512

    43fbb3aa4ec80073ee98b64c0ade9011e14fee1e0cabf3f9378c4096ee02b864d16e8e9a8e336a833a97136c28a335da96c0b2764a25605040fdeb09dded2503

  • SSDEEP

    393216:8Xrg24dyVnq2PJ1E7hSHMiusfjEo0Uqr+9JDiQB9X:8cddyVXJOufQo0Uqk+O

Score
8/10
discoveryevasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    evasion
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\f80bc12ffee2539f5827757dc8052decbbd795e604a58d8c83ae357cf5055151.exe
    "C:\Users\Admin\AppData\Local\Temp\f80bc12ffee2539f5827757dc8052decbbd795e604a58d8c83ae357cf5055151.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4756
    • C:\Users\Admin\AppData\Local\Temp\update\kcinst.exe
      C:\Users\Admin\AppData\Local\Temp\update\kcinst.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2904
    • C:\Users\Admin\AppData\Local\Temp\update\letsvpn-latest.exe
      C:\Users\Admin\AppData\Local\Temp\update\letsvpn-latest.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3104
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1644
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:5028
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3544
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1900
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1428
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5020
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2524
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3092
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2876
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3872
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4392
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsVPN
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:536
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2396
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Modifies registry class
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4272
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C ipconfig /all
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4004
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:3992
          • C:\Windows\SysWOW64\netsh.exe
            C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3620
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C route print
            5⤵
            • System Location Discovery: System Language Discovery
            PID:960
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4880
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            PID:3548
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1208
  • C:\Users\Admin\AppData\Local\Temp\update\kcinst.exe
    C:\Users\Admin\AppData\Local\Temp\\update\kcinst.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4244
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4400
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{38ac6c73-d087-2c47-9332-dd1123413e27}\oemvista.inf" "9" "4d14a44ff" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4852
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000178"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2412
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:4120
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
    1⤵
      PID:1052
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:1888

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      2
      T1059

      PowerShell

      1
      T1059.001

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Defense Evasion

      Impair Defenses

      1
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Modify Registry

      2
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Credential Access

      Discovery

      Network Service Discovery

      1
      T1046

      Peripheral Device Discovery

      2
      T1120

      Query Registry

      5
      T1012

      System Information Discovery

      5
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
        Filesize

        318B

        MD5

        b34636a4e04de02d079ba7325e7565f0

        SHA1

        f32c1211eac22409bb195415cb5a8063431f75cd

        SHA256

        a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

        SHA512

        6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

        Download Submit

      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        Filesize

        240KB

        MD5

        bd8643e5db648810348aa0755e455b70

        SHA1

        119cb1fb3057d9759d0abb3dfdafc460456c1cc4

        SHA256

        bec6a116ea2224dd1532c6eaf20e4d61199240e55ccd0270199fbd22f2806477

        SHA512

        b8033d8989c66431e1771ffc6d2549a4d1e32b8612b7331e7a2931ddad3e31c8a7e1af8ef129883034b1fcf466b8ad0e1cab431cbf5c20c724f4eef53468f714

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
        Filesize

        1.5MB

        MD5

        ca72f8ead2ae568acc481f685385fb60

        SHA1

        887a1d53c8b61c81a80592ff62cf9cdf56b29d18

        SHA256

        d287af28a137d9c015531eae28815d2b0d0a53879318f104ef34e5d86e2c4618

        SHA512

        8da648e1363d490d6a4ee5ec9e38aec86384f345ae5fd58150b2affce8c3c208e1a55598cfe820d00e9448910598ffde29d2824275ebaafaa7d33279898a2e4c

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe.config
        Filesize

        26KB

        MD5

        6126a1ab971d6bd4761f45791af90b1e

        SHA1

        36013821807f6fe08fe3b60a22ec519fd3e5579c

        SHA256

        9b7b7ec30f305b3cd9da40662f95ed57ae89ed8afd2b11d26503e387ff3c262d

        SHA512

        9f74f9f4ad593980337099717ba1e6b584530ee0e192b137297961d1550a70ae3a30fc1bf3e6e670fb817682354648d610f2a542b753a61f397ccaca20908510

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsVPNDomainModel.dll
        Filesize

        20KB

        MD5

        85bee1626071af1b07e79fc7963731e4

        SHA1

        d804e63940798891928f3ba29be85cf06fbb9769

        SHA256

        222f84cd3111f90b7ce045119e63678ee180ab0a7c4f48cae25f097ee425debe

        SHA512

        6649931736a607dceea5ec8180e07c14c331761a7dd0fa5ab4187d3302c0a51262ccce40024d6540f3453d8bdd43785c5f8d45e9c5252e097b69b30fced78832

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\Newtonsoft.Json.dll
        Filesize

        693KB

        MD5

        33a3c1df70cfab1888a4b20565515f81

        SHA1

        c1bfab7454dda45074a6e2b9ae4e9a2712830af6

        SHA256

        0c3c293507c487b76021baaded76defb0fecaf01c1327a448a9b756987595a9e

        SHA512

        76d3e0c34c5e793283910f93af3693355abdd374cf50234496cf3bbebf82a381113fbb4d53ad469f2f5a001b2cb96c761310a3825f8973ae61a4e8b59061cb28

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\Utils.dll
        Filesize

        126KB

        MD5

        8af72dc9783c52125e229f8b79afba94

        SHA1

        71178bc7cfced6bc5dcb45ed666cdbe2c55182dd

        SHA256

        68ae722154cebfb3a3ca59b135e182a68fa0d6966a089008028f97022849bbc5

        SHA512

        dcada700522b78fe0006e84c6599a9857269512eb65a68c0475635f76d5805c43decad74232eb39dae83f987b3dabafe07129d44cce950c8dc9efd11901599e2

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\log4net.config
        Filesize

        1KB

        MD5

        7a7521bc7f838610905ce0286324ce39

        SHA1

        8ab90dd0c4b6edb79a6af2233340d0f59e9ac195

        SHA256

        2a322178557c88cc3c608101e8fc84bfd2f8fa9b81483a443bb3d09779de218d

        SHA512

        b25dfdce0977eaf7159df5eabe4b147a6c0adac39c84d1c7a9fe748446a10c8d2e20d04cf36221057aa210633df65f2a460821c8c79a2db16c912ec53a714d83

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\log4net.dll
        Filesize

        273KB

        MD5

        5b9a663d7584d8e605b0c39031ec485a

        SHA1

        b7d86ebe4e18cb6d2a48a1c97ac6f7e39c8a9b91

        SHA256

        e45afce6eff080d568e3e059498f5768585143336c600011273366905f4fc635

        SHA512

        b02bd950384cf3d656c4b8f590013392e3028c6183aa9321bd91b6fc1f5d41b03771313ca5e3305398a60642fa14fc5a98daf3e6decba586c80861bafcbf0c64

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\OemVista.inf
        Filesize

        7KB

        MD5

        26009f092ba352c1a64322268b47e0e3

        SHA1

        e1b2220cd8dcaef6f7411a527705bd90a5922099

        SHA256

        150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

        SHA512

        c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        Filesize

        99KB

        MD5

        1e3cf83b17891aee98c3e30012f0b034

        SHA1

        824f299e8efd95beca7dd531a1067bfd5f03b646

        SHA256

        9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f

        SHA512

        fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        Filesize

        1KB

        MD5

        33b19d75aa77114216dbc23f43b195e3

        SHA1

        36a6c3975e619e0c5232aa4f5b7dc1fec9525535

        SHA256

        b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

        SHA512

        676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        11KB

        MD5

        316953a7b1a8fd54ac3e2d3d4ab47047

        SHA1

        54d9655a0cd381074a4449286d3d1b76969df183

        SHA256

        d4e26ac9f6f66205fe8a86f1eda0ebb32a494d40ede810031d1133438ce1a940

        SHA512

        a206940212d268d26c7330faec2493bfeba28cc8f0ece209748042410a0569b19130e8f38f7e8a7669e5a103ee1d6bdb6f1f4c4993e4184ae211da8c43b5163c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fgyye1dg.yn0.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsbA29A.tmp\System.dll
        Filesize

        12KB

        MD5

        192639861e3dc2dc5c08bb8f8c7260d5

        SHA1

        58d30e460609e22fa0098bc27d928b689ef9af78

        SHA256

        23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

        SHA512

        6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsbA29A.tmp\modern-wizard.bmp
        Filesize

        51KB

        MD5

        7f8e1969b0874c8fb9ab44fc36575380

        SHA1

        3057c9ce90a23d29f7d0854472f9f44e87b0f09a

        SHA256

        076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd

        SHA512

        7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsbA29A.tmp\nsDialogs.dll
        Filesize

        9KB

        MD5

        b7d61f3f56abf7b7ff0d4e7da3ad783d

        SHA1

        15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

        SHA256

        89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

        SHA512

        6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsbA29A.tmp\nsExec.dll
        Filesize

        7KB

        MD5

        11092c1d3fbb449a60695c44f9f3d183

        SHA1

        b89d614755f2e943df4d510d87a7fc1a3bcf5a33

        SHA256

        2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

        SHA512

        c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\update\KcInst32.dll
        Filesize

        255KB

        MD5

        3d197a425190b754cd72f79c46edcacf

        SHA1

        d550711db2fd6d49ab62670f7b5374213873fcdb

        SHA256

        d464b80f9d383e9ec7b7260b89d3f9451e30ff80069e6a9c79b5e1282a3d671f

        SHA512

        34db88acbfbefa12c87b62dbb988e7b306f2ee91e04ed17bfc5045d9f50335a4b6670b4a5c7e311585b5c790f885fc8564bc6e13b88e63edafe6acfcdda41a96

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\update\VCRUNTIME140.dll
        Filesize

        107KB

        MD5

        ded0fb624c202e3595551256e3bc0ba2

        SHA1

        97c0c52f69fe76c9f1469f3cef78e12e598ad325

        SHA256

        2aebc4e4ca7645188d12950ca68b39f71ebd86da4228419800c1b1a3754f3130

        SHA512

        e7b5b9e7898361254903f1dd8b6f4a49fc0854460a427f4249e9e5e1b95c116a7be61e9ec43f02f70a56ad5ad3ce5205d748525cb40829cc49dd835b605c9fef

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\update\kcinst.exe
        Filesize

        117KB

        MD5

        71f004189b77c2f668c30ec67b876e51

        SHA1

        425ccabbb9f238f9cb9b3f10546894d57d16a164

        SHA256

        2aac0a7e1295e3307b1b7c4d2dc9ea5c84245df02981cde43e88fe50529fb38b

        SHA512

        daff0c7a21a773851f0963aff29eb3aee5832a73764ccba87ab4eb6d79752485a35a41ad19621dda97058c679b7a7258b45e402299d4a3a0f060419aaea9ec2f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\update\kcinst.ini
        Filesize

        180KB

        MD5

        f2e64ea08fd129633120c7c0d4af0afa

        SHA1

        db7a035031086d88610d6d0353c52f1c06391a71

        SHA256

        f94bf192819a8bc48a1475b2a32435e130f5732c9394b7c95c791dd115426631

        SHA512

        6992767f5a3ebfbc10cd6497b159ccd3bfe49c2b306899815df5bec292aaa62698a9b02c6f12dc1acea8592816950219b91b96e0863aace1e2f5c865e6977c38

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\update\letsvpn-latest.exe
        Filesize

        14.7MB

        MD5

        e039e221b48fc7c02517d127e158b89f

        SHA1

        79eed88061472ae590616556f31576ca13bfc7fb

        SHA256

        dc30e5dab15392627d30a506f6304030c581fc00716703fc31add10ff263d70b

        SHA512

        87231c025bb94771e89a639c9cb1528763f096059f8806227b8ab45a8f1ea5cd3d94fdc91cb20dd140b91a14904653517f7b6673a142a864a58a2726d14ae4b8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\update\libCLI.dll
        Filesize

        32KB

        MD5

        3e513045bc9ead3c27f0e7116cfc4264

        SHA1

        87eb43d9f727cbb7221b5be7ccf648c5219dfd17

        SHA256

        842bda02e8a550e425992c100b70351c301eab46041180db023add78b0e6c553

        SHA512

        8c465363d5a12648578ea8ee98766acd9f42f31a7dee4f56697499fed5df2cf34422565b76efdb8e627157f0163b632baa9a0e7730ae57b4fb43b62f6f46ac35

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\update\msvcp140.dll
        Filesize

        559KB

        MD5

        c3d497b0afef4bd7e09c7559e1c75b05

        SHA1

        295998a6455cc230da9517408f59569ea4ed7b02

        SHA256

        1e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98

        SHA512

        d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\update\vcruntime140_1.dll
        Filesize

        49KB

        MD5

        f498619721756332ef731f1b72b7f29e

        SHA1

        5beb1e7f35c33bf636cf1a336b3a02a6f02b0394

        SHA256

        fd1cc0c1287caf736c7e1e4d9aee80fd74cfdfa52563ddd126c03f45542d45b6

        SHA512

        ce98577b8783a6b0305ede64811b6a8e094a237589530cb0cbc3af3530d5503f3bf5abaa2b2abcf38f2d3588d5e54f2a322ff78ea8296f0327627eea0da5a8cd

        Download Submit

      • \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
        Filesize

        38KB

        MD5

        c10ccdec5d7af458e726a51bb3cdc732

        SHA1

        0553aab8c2106abb4120353360d747b0a2b4c94f

        SHA256

        589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

        SHA512

        7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

        Download Submit

      • \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
        Filesize

        10KB

        MD5

        f73ac62e8df97faf3fc8d83e7f71bf3f

        SHA1

        619a6e8f7a9803a4c71f73060649903606beaf4e

        SHA256

        cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

        SHA512

        f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

        Download Submit

      • memory/1644-30-0x00000000055D0000-0x0000000005636000-memory.dmp

        Filesize

        408KB

        Download

      • memory/1644-46-0x0000000074190000-0x0000000074940000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/1644-24-0x000000007419E000-0x000000007419F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1644-25-0x00000000046E0000-0x0000000004716000-memory.dmp

        Filesize

        216KB

        Download

      • memory/1644-27-0x0000000004DD0000-0x00000000053F8000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/1644-26-0x0000000074190000-0x0000000074940000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/1644-28-0x0000000074190000-0x0000000074940000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/1644-29-0x0000000005430000-0x0000000005452000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1644-31-0x0000000005640000-0x00000000056A6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/1644-41-0x00000000056B0000-0x0000000005A04000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/1644-42-0x0000000005CF0000-0x0000000005D0E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/1644-43-0x0000000005D30000-0x0000000005D7C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4244-74-0x0000000140000000-0x0000000140029000-memory.dmp

        Filesize

        164KB

        Download

      • memory/4244-71-0x0000000140000000-0x0000000140029000-memory.dmp

        Filesize

        164KB

        Download

      • memory/4244-693-0x00000000029B0000-0x00000000029FE000-memory.dmp

        Filesize

        312KB

        Download

      • memory/4244-72-0x0000000140000000-0x0000000140029000-memory.dmp

        Filesize

        164KB

        Download

      • memory/4244-694-0x0000000180000000-0x0000000180076000-memory.dmp

        Filesize

        472KB

        Download

      • memory/4244-73-0x0000000140000000-0x0000000140029000-memory.dmp

        Filesize

        164KB

        Download

      • memory/4244-753-0x00000000029B0000-0x00000000029FE000-memory.dmp

        Filesize

        312KB

        Download

      • memory/4244-76-0x00000000029B0000-0x00000000029FE000-memory.dmp

        Filesize

        312KB

        Download

      • memory/4244-75-0x00000000029B0000-0x00000000029FE000-memory.dmp

        Filesize

        312KB

        Download

      • memory/4244-79-0x0000000140000000-0x0000000140029000-memory.dmp

        Filesize

        164KB

        Download

      • memory/4244-78-0x00000000029B0000-0x00000000029FE000-memory.dmp

        Filesize

        312KB

        Download

      • memory/4244-77-0x00000000029B0000-0x00000000029FE000-memory.dmp

        Filesize

        312KB

        Download

      • memory/4272-675-0x0000000000350000-0x00000000004D4000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/4272-762-0x0000000034990000-0x00000000349A0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4272-831-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-830-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-829-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-828-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-827-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-826-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-824-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-679-0x0000000004CB0000-0x0000000004CD4000-memory.dmp

        Filesize

        144KB

        Download

      • memory/4272-823-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-683-0x0000000005120000-0x0000000005166000-memory.dmp

        Filesize

        280KB

        Download

      • memory/4272-687-0x00000000027D0000-0x00000000027DA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4272-822-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-820-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-807-0x0000000038A10000-0x0000000038A21000-memory.dmp

        Filesize

        68KB

        Download

      • memory/4272-692-0x00000000053C0000-0x0000000005472000-memory.dmp

        Filesize

        712KB

        Download

      • memory/4272-806-0x00000000388E0000-0x0000000038983000-memory.dmp

        Filesize

        652KB

        Download

      • memory/4272-796-0x0000000036CE0000-0x0000000036D12000-memory.dmp

        Filesize

        200KB

        Download

      • memory/4272-700-0x0000000005480000-0x00000000057D4000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/4272-705-0x0000000005F70000-0x000000000649C000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/4272-706-0x0000000005D00000-0x0000000005D22000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4272-707-0x0000000005E90000-0x0000000005EAE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4272-708-0x0000000005EB0000-0x0000000005ECA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4272-709-0x0000000005EE0000-0x0000000005EEA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4272-710-0x0000000005F20000-0x0000000005F46000-memory.dmp

        Filesize

        152KB

        Download

      • memory/4272-711-0x0000000005ED0000-0x0000000005ED8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4272-712-0x0000000005EF0000-0x0000000005EFA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4272-713-0x0000000005F00000-0x0000000005F0A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4272-714-0x000000000EFE0000-0x000000000EFEA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4272-715-0x000000002F920000-0x000000002F946000-memory.dmp

        Filesize

        152KB

        Download

      • memory/4272-716-0x000000002F4A0000-0x000000002F4B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4272-717-0x00000000305E0000-0x0000000030672000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4272-722-0x000000002FFE0000-0x000000002FFE8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4272-723-0x00000000306F0000-0x0000000030728000-memory.dmp

        Filesize

        224KB

        Download

      • memory/4272-724-0x00000000306B0000-0x00000000306BE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4272-731-0x00000000307B0000-0x00000000307C2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4272-738-0x0000000033AB0000-0x0000000034054000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4272-741-0x00000000309A0000-0x00000000309A8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4272-743-0x00000000309F0000-0x0000000030A04000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4272-744-0x0000000031F70000-0x0000000031F78000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4272-742-0x00000000309D0000-0x00000000309E2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4272-745-0x0000000033840000-0x000000003385E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4272-789-0x0000000036990000-0x00000000369DC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4272-754-0x0000000034370000-0x0000000034380000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4272-755-0x0000000034530000-0x000000003456A000-memory.dmp

        Filesize

        232KB

        Download

      • memory/4272-756-0x00000000343D0000-0x00000000343D8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4272-757-0x00000000343E0000-0x00000000343F0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4272-758-0x0000000034570000-0x000000003458E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4272-759-0x000000006DC80000-0x000000006E6E8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4272-760-0x00000000349A0000-0x00000000349B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4272-761-0x00000000349B0000-0x00000000349C6000-memory.dmp

        Filesize

        88KB

        Download

      • memory/4272-788-0x0000000035EE0000-0x0000000035F2A000-memory.dmp

        Filesize

        296KB

        Download

      • memory/4272-763-0x0000000035B10000-0x0000000035C96000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/4272-778-0x0000000035CA0000-0x0000000035D16000-memory.dmp

        Filesize

        472KB

        Download

      • memory/5028-546-0x0000000007AB0000-0x0000000007B53000-memory.dmp

        Filesize

        652KB

        Download

      • memory/5028-550-0x0000000007E60000-0x0000000007EF6000-memory.dmp

        Filesize

        600KB

        Download

      • memory/5028-532-0x0000000006B70000-0x0000000006BBC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/5028-534-0x0000000006E90000-0x0000000006EC2000-memory.dmp

        Filesize

        200KB

        Download

      • memory/5028-535-0x0000000070430000-0x000000007047C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/5028-545-0x0000000006E50000-0x0000000006E6E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/5028-526-0x0000000006220000-0x0000000006574000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/5028-548-0x0000000007BE0000-0x0000000007BFA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/5028-555-0x0000000007E40000-0x0000000007E48000-memory.dmp

        Filesize

        32KB

        Download

      • memory/5028-549-0x0000000007C30000-0x0000000007C3A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/5028-547-0x0000000008200000-0x000000000887A000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/5028-551-0x0000000007DC0000-0x0000000007DD1000-memory.dmp

        Filesize

        68KB

        Download

      • memory/5028-552-0x0000000007DF0000-0x0000000007DFE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/5028-553-0x0000000007E00000-0x0000000007E14000-memory.dmp

        Filesize

        80KB

        Download

      • memory/5028-554-0x0000000007F00000-0x0000000007F1A000-memory.dmp

        Filesize

        104KB

        Download