Overview

overview

8

Static

static

3

f80bc12ffe...51.exe

windows7-x64

8

f80bc12ffe...51.exe

windows10-2004-x64

8

kcinst.exe

windows7-x64

1

kcinst.exe

windows10-2004-x64

1

kcinst32.dll

windows7-x64

1

kcinst32.dll

windows10-2004-x64

1

letsvpn-latest.exe

windows7-x64

8

letsvpn-latest.exe

windows10-2004-x64

8

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

driver/tap0901.sys

windows10-2004-x64

1

driver/tapinstall.exe

windows7-x64

1

driver/tapinstall.exe

windows10-2004-x64

1

libCLI.dll

windows7-x64

1

libCLI.dll

windows10-2004-x64

1

msvcp140.dll

windows7-x64

1

msvcp140.dll

windows10-2004-x64

1

vcruntime140.dll

windows7-x64

1

vcruntime140.dll

windows10-2004-x64

1

vcruntime140_1.dll

windows7-x64

1

vcruntime140_1.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2024, 14:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    letsvpn-latest.exe

  • Size

    14.7MB

  • MD5

    e039e221b48fc7c02517d127e158b89f

  • SHA1

    79eed88061472ae590616556f31576ca13bfc7fb

  • SHA256

    dc30e5dab15392627d30a506f6304030c581fc00716703fc31add10ff263d70b

  • SHA512

    87231c025bb94771e89a639c9cb1528763f096059f8806227b8ab45a8f1ea5cd3d94fdc91cb20dd140b91a14904653517f7b6673a142a864a58a2726d14ae4b8

  • SSDEEP

    393216:3Ie8M7oB2JNBXx9PMkglRy3mtFFu9zDVKZpw:3Rh8B2vB2c+kZD

Score
8/10
discoveryevasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
    "C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:468
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4356
    • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
      "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1172
    • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
      "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1528
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c netsh advfirewall firewall Delete rule name=lets
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall Delete rule name=lets
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1740
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c netsh advfirewall firewall Delete rule name=lets.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4752
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2204
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4388
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4292
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4948
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4780
      • C:\Windows\SysWOW64\netsh.exe
        netsh advfirewall firewall Delete rule name=LetsVPN
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1492
    • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
      "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4444
    • C:\Program Files (x86)\letsvpn\LetsPRO.exe
      "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3884
      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1844
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C ipconfig /all
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2136
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            5⤵
            • System Location Discovery: System Language Discovery
            • Gathers network information
            PID:4696
        • C:\Windows\SysWOW64\netsh.exe
          C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4948
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C route print
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1336
          • C:\Windows\SysWOW64\ROUTE.EXE
            route print
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4228
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C arp -a
          4⤵
          • Network Service Discovery
          • System Location Discovery: System Language Discovery
          PID:4868
          • C:\Windows\SysWOW64\ARP.EXE
            arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            PID:552
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{acff2139-913c-454f-a4eb-54eda85f2254}\oemvista.inf" "9" "4d14a44ff" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1876
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000138"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4104
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:3892
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
    1⤵
      PID:4584
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:3148

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      2
      T1059

      PowerShell

      1
      T1059.001

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Defense Evasion

      Impair Defenses

      1
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Modify Registry

      2
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Credential Access

      Discovery

      Network Service Discovery

      1
      T1046

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      3
      T1012

      System Information Discovery

      4
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
        Filesize

        318B

        MD5

        b34636a4e04de02d079ba7325e7565f0

        SHA1

        f32c1211eac22409bb195415cb5a8063431f75cd

        SHA256

        a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

        SHA512

        6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

        Download Submit

      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        Filesize

        240KB

        MD5

        bd8643e5db648810348aa0755e455b70

        SHA1

        119cb1fb3057d9759d0abb3dfdafc460456c1cc4

        SHA256

        bec6a116ea2224dd1532c6eaf20e4d61199240e55ccd0270199fbd22f2806477

        SHA512

        b8033d8989c66431e1771ffc6d2549a4d1e32b8612b7331e7a2931ddad3e31c8a7e1af8ef129883034b1fcf466b8ad0e1cab431cbf5c20c724f4eef53468f714

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\CommunityToolkit.Mvvm.dll
        Filesize

        109KB

        MD5

        143351606a574d84328219a7c18c7219

        SHA1

        8e47c7b530f40553f4a88daff11d78255cc77730

        SHA256

        cbe3b5714c52ad9ff8885d9893c9ed77ad54485a7c5bae3a75151c06d3ae7c4f

        SHA512

        b4698855a37639cac6dd4c400d11028bba1433f43e811e23881a72f7875048c77cf0dbd8bab8c0374ae7182fe41f37f69f5942d770fbbead86b12805b6647291

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
        Filesize

        1.5MB

        MD5

        ca72f8ead2ae568acc481f685385fb60

        SHA1

        887a1d53c8b61c81a80592ff62cf9cdf56b29d18

        SHA256

        d287af28a137d9c015531eae28815d2b0d0a53879318f104ef34e5d86e2c4618

        SHA512

        8da648e1363d490d6a4ee5ec9e38aec86384f345ae5fd58150b2affce8c3c208e1a55598cfe820d00e9448910598ffde29d2824275ebaafaa7d33279898a2e4c

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe.config
        Filesize

        26KB

        MD5

        6126a1ab971d6bd4761f45791af90b1e

        SHA1

        36013821807f6fe08fe3b60a22ec519fd3e5579c

        SHA256

        9b7b7ec30f305b3cd9da40662f95ed57ae89ed8afd2b11d26503e387ff3c262d

        SHA512

        9f74f9f4ad593980337099717ba1e6b584530ee0e192b137297961d1550a70ae3a30fc1bf3e6e670fb817682354648d610f2a542b753a61f397ccaca20908510

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsVPNDomainModel.dll
        Filesize

        20KB

        MD5

        85bee1626071af1b07e79fc7963731e4

        SHA1

        d804e63940798891928f3ba29be85cf06fbb9769

        SHA256

        222f84cd3111f90b7ce045119e63678ee180ab0a7c4f48cae25f097ee425debe

        SHA512

        6649931736a607dceea5ec8180e07c14c331761a7dd0fa5ab4187d3302c0a51262ccce40024d6540f3453d8bdd43785c5f8d45e9c5252e097b69b30fced78832

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsVPNInfraStructure.dll
        Filesize

        23KB

        MD5

        f470c77c6226b6e4ef64448be9d88523

        SHA1

        4eea58baa9b37224c5e37f113aa6084c8ace46ac

        SHA256

        6e97c6e8bdb1fe484d0253175faf908f4e6800e4ab76c0281eca3dafcf8b8c24

        SHA512

        78613d526066c2d986e2984f3d71eeb8ee020d14d333132c35489e70b02e2124506871b28c7b0fc36d3676f478ce9e89fee0a693f6c5942f3399f7b4062e842e

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\Newtonsoft.Json.dll
        Filesize

        693KB

        MD5

        33a3c1df70cfab1888a4b20565515f81

        SHA1

        c1bfab7454dda45074a6e2b9ae4e9a2712830af6

        SHA256

        0c3c293507c487b76021baaded76defb0fecaf01c1327a448a9b756987595a9e

        SHA512

        76d3e0c34c5e793283910f93af3693355abdd374cf50234496cf3bbebf82a381113fbb4d53ad469f2f5a001b2cb96c761310a3825f8973ae61a4e8b59061cb28

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\System.Buffers.dll
        Filesize

        21KB

        MD5

        dbfc345d34c92fae11770079b9f4381b

        SHA1

        5d82cd91009f08b28696e6babfeda03958746d10

        SHA256

        397fd87e509ba39b4c5a5b191e3cc6d7867e0ee7729f04efe7f39cf4276dbeea

        SHA512

        15a852cc4320a6fa2b7bf25dcb1cacb97b4ccb64ff036bc68c17dc3ee08ac5f8229ac6bacd4dd77bf6c22aa89a6d882e7c121ee90940fea4571b30e74f37c9df

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\System.Memory.dll
        Filesize

        138KB

        MD5

        2b370cc14974e2c9955a2a3bdb5cb78a

        SHA1

        98878fb3998e492cf964a2e2af2ca187372ce5b5

        SHA256

        334ed3950898aa1f1a62a15bc411972246ab59498ecc9418f75695a2c1a5ba71

        SHA512

        f5c06d3f184baa1d7a6c9ebff9c5f5bbe87f61318710b0b19a81ce2fa26d3fabfd2af504d558c8b35a81e4c0846325260a2a425f2f68fde2b075addecadacb3d

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\System.Runtime.CompilerServices.Unsafe.dll
        Filesize

        18KB

        MD5

        e0c5b0735a94152bc191a01b57c89db4

        SHA1

        15f546b9ea478fa2cee8c06e8d178a452056a7bc

        SHA256

        6ba160798e7d5ed98328c938c40ce1b8db1b3e603926e7c5220f5b22b243f8e1

        SHA512

        8b39993adea19d6697b929cebd529f1ae812379973e1e71c5459a5bc05608d071a377d4d88320c67b2424dfc681c97a01e6b361b6101d4720a49acd8e403c2c3

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\System.Runtime.InteropServices.RuntimeInformation.dll
        Filesize

        21KB

        MD5

        2a27f887342305cecd5ba36c8dbd4267

        SHA1

        2ca43487e37a67824b071d2870765f26c33ef7f2

        SHA256

        26a04bc90979886d477bb9777545e75a65c5f67443fdb5185c2fea249afc882b

        SHA512

        8d25ed902e2ca4191118b75cae0ea6338d0ce6aac3d10c08288e802704a115b15988a764899f3368aca0e7798933c5d4925721d82d7a7228372f435a36e1eafe

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\Utils.dll
        Filesize

        126KB

        MD5

        8af72dc9783c52125e229f8b79afba94

        SHA1

        71178bc7cfced6bc5dcb45ed666cdbe2c55182dd

        SHA256

        68ae722154cebfb3a3ca59b135e182a68fa0d6966a089008028f97022849bbc5

        SHA512

        dcada700522b78fe0006e84c6599a9857269512eb65a68c0475635f76d5805c43decad74232eb39dae83f987b3dabafe07129d44cce950c8dc9efd11901599e2

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\log4net.config
        Filesize

        1KB

        MD5

        7a7521bc7f838610905ce0286324ce39

        SHA1

        8ab90dd0c4b6edb79a6af2233340d0f59e9ac195

        SHA256

        2a322178557c88cc3c608101e8fc84bfd2f8fa9b81483a443bb3d09779de218d

        SHA512

        b25dfdce0977eaf7159df5eabe4b147a6c0adac39c84d1c7a9fe748446a10c8d2e20d04cf36221057aa210633df65f2a460821c8c79a2db16c912ec53a714d83

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\log4net.dll
        Filesize

        273KB

        MD5

        5b9a663d7584d8e605b0c39031ec485a

        SHA1

        b7d86ebe4e18cb6d2a48a1c97ac6f7e39c8a9b91

        SHA256

        e45afce6eff080d568e3e059498f5768585143336c600011273366905f4fc635

        SHA512

        b02bd950384cf3d656c4b8f590013392e3028c6183aa9321bd91b6fc1f5d41b03771313ca5e3305398a60642fa14fc5a98daf3e6decba586c80861bafcbf0c64

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\OemVista.inf
        Filesize

        7KB

        MD5

        26009f092ba352c1a64322268b47e0e3

        SHA1

        e1b2220cd8dcaef6f7411a527705bd90a5922099

        SHA256

        150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

        SHA512

        c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        Filesize

        99KB

        MD5

        1e3cf83b17891aee98c3e30012f0b034

        SHA1

        824f299e8efd95beca7dd531a1067bfd5f03b646

        SHA256

        9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f

        SHA512

        fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        Filesize

        1KB

        MD5

        33b19d75aa77114216dbc23f43b195e3

        SHA1

        36a6c3975e619e0c5232aa4f5b7dc1fec9525535

        SHA256

        b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

        SHA512

        676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        11KB

        MD5

        f8cc0bdd6d32cefba14329efeb3c5e1d

        SHA1

        a8b07ad8c39ec023a0e38d795595ba6038a826a0

        SHA256

        8ecc7399fdff7e4d3ae4cc01bdf73bbaafa7f3be0f2edc4734ca8ce92d795645

        SHA512

        64607e44919636cf0312d0230b5cb00ec6ddea0047a02ae30654c687cd1089dd80c7512a320609a6c56e8b46c460e7eedbf11ab865d88f394903fa85d8de113d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yper0m4u.vvl.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nso9C8F.tmp\System.dll
        Filesize

        12KB

        MD5

        192639861e3dc2dc5c08bb8f8c7260d5

        SHA1

        58d30e460609e22fa0098bc27d928b689ef9af78

        SHA256

        23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

        SHA512

        6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nso9C8F.tmp\modern-wizard.bmp
        Filesize

        51KB

        MD5

        7f8e1969b0874c8fb9ab44fc36575380

        SHA1

        3057c9ce90a23d29f7d0854472f9f44e87b0f09a

        SHA256

        076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd

        SHA512

        7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nso9C8F.tmp\nsDialogs.dll
        Filesize

        9KB

        MD5

        b7d61f3f56abf7b7ff0d4e7da3ad783d

        SHA1

        15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

        SHA256

        89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

        SHA512

        6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nso9C8F.tmp\nsExec.dll
        Filesize

        7KB

        MD5

        11092c1d3fbb449a60695c44f9f3d183

        SHA1

        b89d614755f2e943df4d510d87a7fc1a3bcf5a33

        SHA256

        2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

        SHA512

        c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

        Download Submit

      • \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
        Filesize

        38KB

        MD5

        c10ccdec5d7af458e726a51bb3cdc732

        SHA1

        0553aab8c2106abb4120353360d747b0a2b4c94f

        SHA256

        589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

        SHA512

        7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

        Download Submit

      • \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
        Filesize

        10KB

        MD5

        f73ac62e8df97faf3fc8d83e7f71bf3f

        SHA1

        619a6e8f7a9803a4c71f73060649903606beaf4e

        SHA256

        cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

        SHA512

        f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

        Download Submit

      • memory/468-25-0x0000000005C60000-0x0000000005C7E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/468-11-0x0000000004DA0000-0x00000000053C8000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/468-10-0x0000000073BB0000-0x0000000074360000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/468-12-0x0000000004CC0000-0x0000000004CE2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/468-9-0x0000000002680000-0x00000000026B6000-memory.dmp

        Filesize

        216KB

        Download

      • memory/468-8-0x0000000073BBE000-0x0000000073BBF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/468-13-0x00000000054D0000-0x0000000005536000-memory.dmp

        Filesize

        408KB

        Download

      • memory/468-14-0x0000000005540000-0x00000000055A6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/468-15-0x0000000005630000-0x0000000005984000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/468-26-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/468-29-0x0000000073BB0000-0x0000000074360000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/1844-711-0x00000000328B0000-0x00000000328C4000-memory.dmp

        Filesize

        80KB

        Download

      • memory/1844-694-0x00000000305A0000-0x00000000305A8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1844-796-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-795-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-794-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-793-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-792-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-637-0x0000000000610000-0x0000000000794000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/1844-641-0x00000000050C0000-0x00000000050E4000-memory.dmp

        Filesize

        144KB

        Download

      • memory/1844-791-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-789-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-649-0x00000000050A0000-0x00000000050AA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1844-788-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-645-0x0000000005540000-0x0000000005586000-memory.dmp

        Filesize

        280KB

        Download

      • memory/1844-787-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-783-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-654-0x0000000005790000-0x0000000005842000-memory.dmp

        Filesize

        712KB

        Download

      • memory/1844-655-0x0000000005880000-0x0000000005BD4000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/1844-656-0x0000000006370000-0x000000000689C000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/1844-657-0x0000000006100000-0x0000000006122000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1844-661-0x0000000006290000-0x00000000062AE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/1844-770-0x0000000038080000-0x00000000380B2000-memory.dmp

        Filesize

        200KB

        Download

      • memory/1844-662-0x00000000062B0000-0x00000000062CA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1844-666-0x00000000062E0000-0x00000000062EA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1844-763-0x0000000036F10000-0x0000000036F21000-memory.dmp

        Filesize

        68KB

        Download

      • memory/1844-670-0x0000000006320000-0x0000000006346000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1844-678-0x00000000062F0000-0x00000000062FA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1844-762-0x0000000036E10000-0x0000000036EB3000-memory.dmp

        Filesize

        652KB

        Download

      • memory/1844-674-0x00000000062D0000-0x00000000062D8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1844-752-0x0000000036AE0000-0x0000000036B56000-memory.dmp

        Filesize

        472KB

        Download

      • memory/1844-751-0x00000000361A0000-0x00000000361EC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/1844-750-0x0000000035C70000-0x0000000035CBA000-memory.dmp

        Filesize

        296KB

        Download

      • memory/1844-682-0x0000000006300000-0x000000000630A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1844-683-0x000000002F9C0000-0x000000002F9CA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1844-684-0x000000002FE60000-0x000000002FE86000-memory.dmp

        Filesize

        152KB

        Download

      • memory/1844-685-0x000000002F9E0000-0x000000002F9F0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1844-688-0x0000000030C60000-0x0000000030CF2000-memory.dmp

        Filesize

        584KB

        Download

      • memory/1844-730-0x0000000033910000-0x0000000033920000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1844-698-0x0000000032930000-0x0000000032968000-memory.dmp

        Filesize

        224KB

        Download

      • memory/1844-699-0x0000000030C40000-0x0000000030C4E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1844-706-0x0000000033F70000-0x0000000034514000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/1844-709-0x0000000032860000-0x0000000032868000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1844-710-0x0000000032890000-0x00000000328A2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1844-712-0x00000000328D0000-0x00000000328D8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1844-729-0x0000000033C10000-0x0000000033C26000-memory.dmp

        Filesize

        88KB

        Download

      • memory/1844-713-0x0000000033B80000-0x0000000033B92000-memory.dmp

        Filesize

        72KB

        Download

      • memory/1844-714-0x0000000033920000-0x000000003393E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/1844-717-0x0000000030F10000-0x0000000030F20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1844-718-0x0000000030F80000-0x0000000030FBA000-memory.dmp

        Filesize

        232KB

        Download

      • memory/1844-719-0x0000000030F40000-0x0000000030F48000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1844-721-0x0000000030F50000-0x0000000030F60000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1844-720-0x000000006D0C0000-0x000000006DB28000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/1844-722-0x0000000030FC0000-0x0000000030FDE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/1844-723-0x0000000035AE0000-0x0000000035C66000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/1844-724-0x0000000030D80000-0x0000000030D90000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4356-507-0x00000000072D0000-0x0000000007373000-memory.dmp

        Filesize

        652KB

        Download

      • memory/4356-509-0x00000000073C0000-0x00000000073DA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4356-481-0x0000000073BB0000-0x0000000073C3D000-memory.dmp

        Filesize

        564KB

        Download

      • memory/4356-491-0x0000000005A90000-0x0000000005DE4000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/4356-493-0x0000000006640000-0x000000000668C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4356-495-0x00000000065E0000-0x0000000006612000-memory.dmp

        Filesize

        200KB

        Download

      • memory/4356-496-0x000000006F8B0000-0x000000006F8FC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4356-506-0x00000000065C0000-0x00000000065DE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4356-518-0x0000000073BB0000-0x0000000073C3D000-memory.dmp

        Filesize

        564KB

        Download

      • memory/4356-480-0x0000000073BB0000-0x0000000073C3D000-memory.dmp

        Filesize

        564KB

        Download

      • memory/4356-508-0x0000000007A00000-0x000000000807A000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/4356-510-0x0000000007410000-0x000000000741A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4356-511-0x0000000007640000-0x00000000076D6000-memory.dmp

        Filesize

        600KB

        Download

      • memory/4356-512-0x00000000075A0000-0x00000000075B1000-memory.dmp

        Filesize

        68KB

        Download

      • memory/4356-513-0x00000000075D0000-0x00000000075DE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4356-514-0x00000000075E0000-0x00000000075F4000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4356-515-0x00000000076E0000-0x00000000076FA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4356-516-0x0000000007620000-0x0000000007628000-memory.dmp

        Filesize

        32KB

        Download