Overview

overview

10

Static

static

1

10152bc59a...e9.msi

windows7-x64

10

10152bc59a...e9.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 03:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    10152bc59a780129df651a3363b3b1cdecec8df442c8442808824a80564f6be9.msi

  • Size

    40.6MB

  • MD5

    4e0c73259e83e8d5f36be55d4a937307

  • SHA1

    539d747d30c16f50ddf6b72da1426709edce5732

  • SHA256

    10152bc59a780129df651a3363b3b1cdecec8df442c8442808824a80564f6be9

  • SHA512

    eaca63ff0faafdd6014864517a9fb92e82d970c99084d6cbf5b493b0b0ca6372541493f4c11b426c09b160369fb4da07d928d74a20078ab3e0743b54e5be99b5

  • SSDEEP

    786432:BxAq3kvG6v0/moop9AaRDEzVARzgsBBSs7ndpTp1Z4qaNrk+0/iClRu:cqUvL8/mfACxgUBSkdvAPy6CPu

Score
10/10
discoveryevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\10152bc59a780129df651a3363b3b1cdecec8df442c8442808824a80564f6be9.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4500
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • UAC bypass
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3696
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:764
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F7A9A10AF5F7E2C87344371F3223ABDC
      2⤵
      • Drops file in Program Files directory
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3560
    • C:\Program Files (x86)\pYkYZuRh.exe
      "C:\Program Files (x86)\pYkYZuRh.exe"
      2⤵
      • Enumerates connected drives
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3184
    • C:\Program Files (x86)\DsGtQhLH.exe
      "C:\Program Files (x86)\DsGtQhLH.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1124
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4400
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3776
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1144
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:4284
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4048
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4764
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1960
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4604
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:220
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2316
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3664
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3692
        • C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe"
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Modifies system certificate store
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2708
          • C:\Windows\SysWOW64\netsh.exe
            C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2352
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C ipconfig /all
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2040
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:4880
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C route print
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4456
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5096
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            PID:2676
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4812
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4568
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fc048f71-1ff9-214f-9a6a-7c5382e88424}\oemvista.inf" "9" "4d14a44ff" "0000000000000134" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2040
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000134"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:4728
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:3624
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:540

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    2
    T1059

    PowerShell

    1
    T1059.001

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Event Triggered Execution

    2
    T1546

    Installer Packages

    1
    T1546.016

    Netsh Helper DLL

    1
    T1546.007

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Event Triggered Execution

    2
    T1546

    Installer Packages

    1
    T1546.016

    Netsh Helper DLL

    1
    T1546.007

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Impair Defenses

    2
    T1562

    Disable or Modify System Firewall

    1
    T1562.004

    Disable or Modify Tools

    1
    T1562.001

    Modify Registry

    3
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    System Binary Proxy Execution

    1
    T1218

    Msiexec

    1
    T1218.007

    Credential Access

    Discovery

    Network Service Discovery

    1
    T1046

    Peripheral Device Discovery

    2
    T1120

    Query Registry

    4
    T1012

    System Information Discovery

    5
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e57c576.rbs
      Filesize

      6KB

      MD5

      eb6cf6324c836dc5d411065583b5b091

      SHA1

      cc7c5962394afed3cab4d787ae9491059345b91d

      SHA256

      cc62b59b1d49465b5772f3c281ed165fb7d95efa623624a727e878f7af6d607a

      SHA512

      3db0345786c0f0e942d866b6c7cba2ccc8973d5b7bf927f2c7f828b4370ac11e168bff9a0a08ec9a8c2b14a4507aaa43d03546290d4a0ec036638b11fe519885

      Download Submit

    • C:\Program Files (x86)\1
      Filesize

      6.0MB

      MD5

      a589ea47d27781243203497042014ee3

      SHA1

      02af54d118fdb181247e76a79a3acfbb074bf6ea

      SHA256

      d25b465e1a59b452605512566d4417cb44a72d07b989f8cb276849bf4f66ac52

      SHA512

      baed6eda05efb91f65812e117730bd3d6587166667dc3b7e2f1f3c802a713829b5b6c9c0287fe37267e4a4a5f941776aa49adcbe45ffa1da99e9b73c99b0a09e

      Download Submit

    • C:\Program Files (x86)\Common Files\DsGtQhLH.lnk
      Filesize

      943B

      MD5

      6ecb65d9a2fa0135b51f99e63b3b8774

      SHA1

      fbd7bc512ac83ff3f4f89c38339ac7c148e2dd3b

      SHA256

      d6c42f1ead5d94fe343b2903f2cd934a5e19e5d8e74cfd9a377272f247d3ab51

      SHA512

      358446a6e83a2181a0c32e0dc3fb4ceb1da7eed08e75bb61a1a96018f1aad04dce591af0b987d5b689087622d926b76b8cea273e9fe124a46cd2db34a2915282

      Download Submit

    • C:\Program Files (x86)\Common Files\DsGtQhLH.lnk~RFe57ca35.TMP
      Filesize

      898B

      MD5

      a6706a76257e5442da75326b13592ca0

      SHA1

      a361eafee6018e2ab3857bfb5e09b61107cdaee7

      SHA256

      b6b9d601f99dd8b65fa6f00d50f0632a86b42665cc4c08916a832b2f14ebf1df

      SHA512

      ffadcaa9f06a52c7afdc60c70d2ddc2382bb5099f0da59ab88215da9de3e09318af30d77d0e50d0965ff81d2ca0fc96b0a8ccbf9350283e7c29c45d282e5661e

      Download Submit

    • C:\Program Files (x86)\DsGtQhLH.exe
      Filesize

      14.5MB

      MD5

      9c44be4ceac0c983a812fd8459511fd0

      SHA1

      bd5aaad4acd523cd2855e8b50a8380365d81e041

      SHA256

      b6750a3631413d71d7ea10292a11e5d0560afb6ccd4ad4baa75d7dc80842f153

      SHA512

      372ddeb1045d49e8f98f17bccffb0e3edc2179e541f8a4493300517327e514c7bf64557250e0f84f7366310a3d7a58a8d5480596f9be075b3f5d9411a49b4d09

      Download Submit

    • C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
      Filesize

      318B

      MD5

      b34636a4e04de02d079ba7325e7565f0

      SHA1

      f32c1211eac22409bb195415cb5a8063431f75cd

      SHA256

      a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

      SHA512

      6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

      Download Submit

    • C:\Program Files (x86)\letsvpn\LetsPRO.exe
      Filesize

      240KB

      MD5

      ea9e2f517b1cc2dbe7f78302dd7fb593

      SHA1

      cb326eeee062bfc20be4d07fa989b001811fc03c

      SHA256

      b1037f963c91ab0f586349d5aede8e25686784f46f031dfc422e0d69a9939f48

      SHA512

      d8d38e5243ff8f8e3f790c3587bf0360afd7dd185886da86ad7ad6111eed121e91eca18bac9563ea4e6984c46f88639f58a2073884567ca982383ec2cf32f0eb

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
      Filesize

      1.4MB

      MD5

      38973dbbfad9619fde39fab919eb9a04

      SHA1

      09c0b7ec430092c41a576565d8cf8e9df40e12fe

      SHA256

      e7806cd45b774d640bfd1f92e0893d28b87117a9dc25edb490da4449d57ca8ac

      SHA512

      fed73ef38f0008ab93589a6f525866a3f73ce9b090e41482dc4933dadc6f1bce1a26990e8f44704e934528d71e6887d0d44bb38f8b5402cf4c9b2880f16eea67

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe.config
      Filesize

      22KB

      MD5

      3b1d12693ee14f307d7e8b1f08ae23c0

      SHA1

      82719e54b457a4e5cc57b33714e67fc0305b6e90

      SHA256

      0b2a37670105e8d30fe0c4aecfad876f669663834a6c91bc89e309fb609032b7

      SHA512

      ac7b99e0fb2e7d656dfc8e5df1fad58e4446c854e6d1d05a48dbd5fe93ab4978c3b206d828d8bcfc874eff0981886be4ae72e063aaccf895959d7cd5456a5e95

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNDomainModel.dll
      Filesize

      21KB

      MD5

      aaf315462a2bfc476f2488349b629b09

      SHA1

      1957786412810c8200393f329925bf7f8fcb9fa0

      SHA256

      af1328e99850c6a0f309b582c451e16aec5b8446a57617198c96f353f7ba60be

      SHA512

      ff1b9590653e1333f3031456d70169e789bedf7a3a7b9c69f9076b99d080d6d6006e2812c831b603972445b097a1003f7fb84fc34cabf4ee97ba10cd09140b4b

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\Newtonsoft.Json.dll
      Filesize

      693KB

      MD5

      4aba39e3b609f3e927d4b4c850a1e9c2

      SHA1

      2fc88fdfe44f49567a4160fc7ceba175bbe851b3

      SHA256

      abf8133f5bda0aa4700b7b4b9a8f4a6e2af8f9fc38def6ebbec7045fda493671

      SHA512

      cdd79270d8e0e7999b899d32fc012e0450d65732b68eba982b91f213e6550d5568239eb29267adefbd61ea4e674c1096d04a1a6cbbf67fd51e6d8b8ab2770f07

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\Utils.dll
      Filesize

      126KB

      MD5

      d615a49b867921d097b87f5653d06da8

      SHA1

      9475f5bd2517a71d68388f04a247725814bb0a39

      SHA256

      ca0a071afff810cae52cce1def9456d4ddb8ca1a165a4b0aae16951a6f337542

      SHA512

      1986d66a9638d0cc998ee0534fe9443a41f8988aca226770934c5a9b7157931ec8c456ff0034ec63ef32da842d6bae31d97003ab5d65f3a7e51c2773dc758cbe

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\log4net.config
      Filesize

      3KB

      MD5

      28f9077c304d8c626554818a5b5f3b3a

      SHA1

      a01f735fe348383795d61aadd6aab0cc3a9db190

      SHA256

      746b5675ea85c21ef4fcc05e072383a7f83c5fe06aaa391fc3046f34b9817c90

      SHA512

      485c175bc13c64601b15243daecbf72621883c2ff294852c9bbb2681937f7ef0bea65361e0f83131ec989432326442ef387c1ccf2a7ca537c6788b8fd5c0021e

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\log4net.dll
      Filesize

      273KB

      MD5

      e281f008a6d29ae21e0173c97e63ef93

      SHA1

      21004cd1d373563298738bdb70f66dca3865c0bd

      SHA256

      146c386529e15c58ca7cb51927616b8310c7ca0855603bc22addbbcdd9502c11

      SHA512

      b8cebc8bbf18aa03872dc74dbab9569682c64dd5c2ad3c07e542ba08bdb1cccfc5a956622daa1c9e218f8d54b9e26b8533091c378b6f386e25f3fccbdc201765

      Download Submit

    • C:\Program Files (x86)\letsvpn\driver\OemVista.inf
      Filesize

      7KB

      MD5

      26009f092ba352c1a64322268b47e0e3

      SHA1

      e1b2220cd8dcaef6f7411a527705bd90a5922099

      SHA256

      150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

      SHA512

      c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

      Download Submit

    • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
      Filesize

      99KB

      MD5

      1e3cf83b17891aee98c3e30012f0b034

      SHA1

      824f299e8efd95beca7dd531a1067bfd5f03b646

      SHA256

      9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f

      SHA512

      fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b

      Download Submit

    • C:\Program Files (x86)\libcurl.dll
      Filesize

      19.4MB

      MD5

      9ff980feb6fccdb08ab3fe6fc5e428f1

      SHA1

      3c60d0fa914291da59a3cc883becd0ea26c1f26a

      SHA256

      d0cdc6b3747195a88b6918926f488215396970aa342e14d6ea819919d274a381

      SHA512

      989d76d721963f46386350c08b4e7a50a52e16d9fc92bc13c7f1fa20997a9aa35a8f144564af9f483b0e3f2fd32d436adfa84cb8638e9c408a79960b6da38618

      Download Submit

    • C:\Program Files (x86)\msvcp100.dll
      Filesize

      412KB

      MD5

      ed40615aa67499e2d2da8389ba9b331a

      SHA1

      09780d2c9d75878f7a9bb94599f3dc9386cf3789

      SHA256

      cd28daeda3c8731030e2077e6eccbb609e2098919b05ff310bef8dce1dce2d8d

      SHA512

      47d94c5f4829a0f901b57084c22b24adefb4aec2f7b8df9ea838e485dbc607aa837ed6d3c7186159499c44a3ff488fb04f770c624649a406854d82cd3baf72ee

      Download Submit

    • C:\Program Files (x86)\msvcr100.dll
      Filesize

      756KB

      MD5

      ef3e115c225588a680acf365158b2f4a

      SHA1

      ecda6d3b4642d2451817833b39248778e9c2cbb0

      SHA256

      25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8

      SHA512

      d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a

      Download Submit

    • C:\Program Files (x86)\pYkYZuRh.exe
      Filesize

      129KB

      MD5

      7ea6be30e745e9556c017439c5e83273

      SHA1

      4e36ae4f8bb1c6a438f8cc6952ec840415b5d9f2

      SHA256

      5a3e4e68ffa8e8796ec0ff3d01473ceafa070dc533a1c268d073ee7abd6c8021

      SHA512

      0a17f4e6e60932282cb28823a77c5ebef7a8c8ee472f00c9ef9eebb0481886647faa698f2c2e193db095c6467f6e41307aff96030fadd3072ba700c1e1e45724

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
      Filesize

      1KB

      MD5

      33b19d75aa77114216dbc23f43b195e3

      SHA1

      36a6c3975e619e0c5232aa4f5b7dc1fec9525535

      SHA256

      b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

      SHA512

      676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      12KB

      MD5

      e28afbcec43d714a297d677b635cbd2e

      SHA1

      c00d8b51035317126e4a025e8eae41198a3fe391

      SHA256

      6088778bcacdfa03f05b2c9e6ab3dbe2a29ea744a1203e122ea24bdf5643ea96

      SHA512

      af62332c1dd0c0a27705eace10e7fec153aa0c4ef21fcf18abdea967d121c904a0345a16fc66a59f6f966ee934a614fd11d5bbf66e6c9f34770b7357960e8e15

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wiccwwo3.45v.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsxCC88.tmp\System.dll
      Filesize

      11KB

      MD5

      75ed96254fbf894e42058062b4b4f0d1

      SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

      SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

      SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsxCC88.tmp\modern-wizard.bmp
      Filesize

      51KB

      MD5

      7f8e1969b0874c8fb9ab44fc36575380

      SHA1

      3057c9ce90a23d29f7d0854472f9f44e87b0f09a

      SHA256

      076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd

      SHA512

      7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsxCC88.tmp\nsDialogs.dll
      Filesize

      9KB

      MD5

      ca95c9da8cef7062813b989ab9486201

      SHA1

      c555af25df3de51aa18d487d47408d5245dba2d1

      SHA256

      feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be

      SHA512

      a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nsxCC88.tmp\nsExec.dll
      Filesize

      6KB

      MD5

      3d366250fcf8b755fce575c75f8c79e4

      SHA1

      2ebac7df78154738d41aac8e27d7a0e482845c57

      SHA256

      8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

      SHA512

      67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

      Download Submit

    • C:\Windows\Installer\MSIC7B6.tmp
      Filesize

      408KB

      MD5

      0901970c2066aed8a97d75aaf1fd3146

      SHA1

      f0c700a4bfcebad9843e01a88bab71b5f38996d8

      SHA256

      41f827e6addfc71d68cd4758336edf602349fb1230256ec135121f95c670d773

      SHA512

      00e12fd2d752a01dfa75550ffaf3a2f337171cec93cd013083c37137a455e93bebd72e7d8487ec3e1de5fe22994f058829a6597765612278c20d601192cbe733

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      24.1MB

      MD5

      9ce170bbdf5bb93b56370aa0dc2aed41

      SHA1

      8864fd89297812d1285aa12b83fefd183f27168e

      SHA256

      24b15006664e7a9274538a28d7bf55604321009047dcc49dc34152bd1a52e0ca

      SHA512

      d29cfdc8f8c0a61c84ffcba42e3783bb3e1f7045c50abd9b5c237fe9840fa5c7f5361a4acee2c83cd39cd7b98250ecd8169c9bd6c14ada7f1412e281bdf35fba

      Download Submit

    • \??\Volume{625ed6c4-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d9cf0ba2-3f9a-464c-86fb-96f61067dccd}_OnDiskSnapshotProp
      Filesize

      6KB

      MD5

      e54f5db71c0478ca74de2d0ee474b917

      SHA1

      9001af88f7eb469792bd88be399acc05a3560526

      SHA256

      8de7787e15d604f6d2730e0277c4a725be2f3746986dd71da452485dad3d92c9

      SHA512

      83de39c0c35d1cd3bd43a9a084d7d553a7c11deaf56e1c5553ea77120147c818e3f6f7332b374b10c98b5c20183d11c6b1512678223b5e91e2f237c9bcaa4bc4

      Download Submit

    • \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
      Filesize

      38KB

      MD5

      c10ccdec5d7af458e726a51bb3cdc732

      SHA1

      0553aab8c2106abb4120353360d747b0a2b4c94f

      SHA256

      589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

      SHA512

      7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

      Download Submit

    • \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
      Filesize

      10KB

      MD5

      f73ac62e8df97faf3fc8d83e7f71bf3f

      SHA1

      619a6e8f7a9803a4c71f73060649903606beaf4e

      SHA256

      cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

      SHA512

      f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

      Download Submit

    • memory/2708-781-0x0000000036180000-0x0000000036192000-memory.dmp

      Filesize

      72KB

      Download

    • memory/2708-778-0x0000000034CB0000-0x0000000034CC2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/2708-845-0x000000006D100000-0x000000006DB67000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/2708-844-0x000000006D100000-0x000000006DB67000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/2708-843-0x000000006D100000-0x000000006DB67000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/2708-842-0x000000006D100000-0x000000006DB67000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/2708-739-0x0000000005AF0000-0x0000000005E44000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/2708-837-0x000000006D100000-0x000000006DB67000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/2708-834-0x000000006D100000-0x000000006DB67000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/2708-833-0x000000006D100000-0x000000006DB67000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/2708-831-0x000000006D100000-0x000000006DB67000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/2708-741-0x0000000006310000-0x0000000006332000-memory.dmp

      Filesize

      136KB

      Download

    • memory/2708-827-0x000000003AB80000-0x000000003ABB2000-memory.dmp

      Filesize

      200KB

      Download

    • memory/2708-826-0x0000000038F20000-0x0000000038F31000-memory.dmp

      Filesize

      68KB

      Download

    • memory/2708-825-0x0000000039410000-0x00000000394B3000-memory.dmp

      Filesize

      652KB

      Download

    • memory/2708-815-0x00000000391C0000-0x0000000039236000-memory.dmp

      Filesize

      472KB

      Download

    • memory/2708-814-0x00000000383D0000-0x000000003841C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/2708-811-0x0000000038060000-0x00000000380AA000-memory.dmp

      Filesize

      296KB

      Download

    • memory/2708-793-0x0000000037F50000-0x0000000037F60000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2708-792-0x0000000037F70000-0x0000000037F86000-memory.dmp

      Filesize

      88KB

      Download

    • memory/2708-789-0x0000000037E10000-0x0000000037E20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2708-788-0x00000000380E0000-0x0000000038266000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2708-787-0x000000006D100000-0x000000006DB67000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/2708-782-0x00000000311A0000-0x00000000311BE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/2708-779-0x0000000035DA0000-0x0000000035DB4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2708-746-0x00000000064D0000-0x00000000064D8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2708-780-0x0000000035DC0000-0x0000000035DC8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2708-740-0x0000000006580000-0x0000000006AAC000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/2708-777-0x0000000034C40000-0x0000000034C48000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2708-774-0x0000000036360000-0x0000000036904000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2708-770-0x0000000034C20000-0x0000000034C2E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/2708-769-0x0000000034C50000-0x0000000034C88000-memory.dmp

      Filesize

      224KB

      Download

    • memory/2708-723-0x0000000000960000-0x0000000000ACE000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/2708-760-0x0000000030640000-0x0000000030648000-memory.dmp

      Filesize

      32KB

      Download

    • memory/2708-727-0x0000000005290000-0x00000000052B4000-memory.dmp

      Filesize

      144KB

      Download

    • memory/2708-754-0x0000000030BF0000-0x0000000030C82000-memory.dmp

      Filesize

      584KB

      Download

    • memory/2708-735-0x0000000005380000-0x000000000538A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2708-751-0x000000002FAA0000-0x000000002FAB0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2708-731-0x0000000005700000-0x0000000005746000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2708-750-0x000000002FF40000-0x000000002FF66000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2708-749-0x000000000F7F0000-0x000000000F7FA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2708-738-0x0000000005A30000-0x0000000005AE2000-memory.dmp

      Filesize

      712KB

      Download

    • memory/2708-838-0x000000006D100000-0x000000006DB67000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/2708-748-0x0000000006510000-0x000000000651A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2708-747-0x00000000064F0000-0x00000000064FA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2708-742-0x0000000006480000-0x000000000649E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/2708-743-0x00000000064A0000-0x00000000064BA000-memory.dmp

      Filesize

      104KB

      Download

    • memory/2708-744-0x00000000064E0000-0x00000000064EA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2708-745-0x0000000006520000-0x0000000006546000-memory.dmp

      Filesize

      152KB

      Download

    • memory/3184-122-0x0000000003D20000-0x0000000004647000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/3184-121-0x0000000003D20000-0x0000000004647000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/3184-124-0x0000000003290000-0x00000000032C8000-memory.dmp

      Filesize

      224KB

      Download

    • memory/3184-128-0x0000000003290000-0x00000000032C8000-memory.dmp

      Filesize

      224KB

      Download

    • memory/3184-127-0x0000000003290000-0x00000000032C8000-memory.dmp

      Filesize

      224KB

      Download

    • memory/3184-457-0x0000000003D20000-0x0000000004647000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/3184-120-0x0000000003D20000-0x0000000004647000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/3184-117-0x0000000003D20000-0x0000000004647000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/3184-114-0x0000000003D20000-0x0000000004647000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/3184-95-0x0000000003D20000-0x0000000004647000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/3184-92-0x0000000010000000-0x0000000011E5A000-memory.dmp

      Filesize

      30.4MB

      Download

    • memory/3184-123-0x0000000003290000-0x00000000032C8000-memory.dmp

      Filesize

      224KB

      Download

    • memory/3184-90-0x0000000000660000-0x0000000000661000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3184-91-0x0000000000670000-0x0000000000671000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3776-583-0x0000000006610000-0x000000000665C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/3776-585-0x00000000066F0000-0x0000000006722000-memory.dmp

      Filesize

      200KB

      Download

    • memory/3776-605-0x0000000007820000-0x000000000783A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/3776-604-0x0000000007710000-0x0000000007724000-memory.dmp

      Filesize

      80KB

      Download

    • memory/3776-603-0x0000000007700000-0x000000000770E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/3776-602-0x00000000076D0000-0x00000000076E1000-memory.dmp

      Filesize

      68KB

      Download

    • memory/3776-601-0x0000000007760000-0x00000000077F6000-memory.dmp

      Filesize

      600KB

      Download

    • memory/3776-600-0x0000000007550000-0x000000000755A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3776-599-0x00000000074D0000-0x00000000074EA000-memory.dmp

      Filesize

      104KB

      Download

    • memory/3776-598-0x0000000007B20000-0x000000000819A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/3776-597-0x0000000006760000-0x0000000006803000-memory.dmp

      Filesize

      652KB

      Download

    • memory/3776-606-0x0000000007750000-0x0000000007758000-memory.dmp

      Filesize

      32KB

      Download

    • memory/3776-596-0x0000000006730000-0x000000000674E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/3776-586-0x000000006FE30000-0x000000006FE7C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/3776-581-0x0000000005E70000-0x00000000061C4000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/4400-88-0x0000000005D10000-0x0000000005D2E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/4400-89-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/4400-87-0x0000000005710000-0x0000000005A64000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/4400-77-0x00000000056A0000-0x0000000005706000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4400-76-0x0000000005630000-0x0000000005696000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4400-75-0x0000000004C40000-0x0000000004C62000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4400-74-0x0000000004F50000-0x0000000005578000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/4400-73-0x0000000002750000-0x0000000002786000-memory.dmp

      Filesize

      216KB

      Download