Overview

overview

10

Static

static

1

10152bc59a...e9.msi

windows7-x64

10

10152bc59a...e9.msi

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 03:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    10152bc59a780129df651a3363b3b1cdecec8df442c8442808824a80564f6be9.msi

  • Size

    40.6MB

  • MD5

    4e0c73259e83e8d5f36be55d4a937307

  • SHA1

    539d747d30c16f50ddf6b72da1426709edce5732

  • SHA256

    10152bc59a780129df651a3363b3b1cdecec8df442c8442808824a80564f6be9

  • SHA512

    eaca63ff0faafdd6014864517a9fb92e82d970c99084d6cbf5b493b0b0ca6372541493f4c11b426c09b160369fb4da07d928d74a20078ab3e0743b54e5be99b5

  • SSDEEP

    786432:BxAq3kvG6v0/moop9AaRDEzVARzgsBBSs7ndpTp1Z4qaNrk+0/iClRu:cqUvL8/mfACxgUBSkdvAPy6CPu

Score
10/10
discoveryevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\10152bc59a780129df651a3363b3b1cdecec8df442c8442808824a80564f6be9.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:432
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • UAC bypass
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1692
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C625F8525820A42AA978DBDA296C893B
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:868
    • C:\Program Files (x86)\pYkYZuRh.exe
      "C:\Program Files (x86)\pYkYZuRh.exe"
      2⤵
      • Enumerates connected drives
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:2188
    • C:\Program Files (x86)\DsGtQhLH.exe
      "C:\Program Files (x86)\DsGtQhLH.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4228
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4584
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5092
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4716
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3016
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4152
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2332
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2004
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3736
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2704
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:228
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1236
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:392
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3028
        • C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe"
          4⤵
          • Adds Run key to start application
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Modifies system certificate store
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:964
          • C:\Windows\SysWOW64\netsh.exe
            C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1968
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C ipconfig /all
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3288
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:2300
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C route print
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1684
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2672
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            PID:3548
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:392
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2912
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3620
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{26845b8a-5f6e-354c-aad4-34674c2e99bf}\oemvista.inf" "9" "4d14a44ff" "0000000000000134" "WinSta0\Default" "0000000000000158" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1436
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000134"
      2⤵
      • Checks SCSI registry key(s)
      PID:2036
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:4596
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:3424

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    2
    T1059

    PowerShell

    1
    T1059.001

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Event Triggered Execution

    2
    T1546

    Installer Packages

    1
    T1546.016

    Netsh Helper DLL

    1
    T1546.007

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Event Triggered Execution

    2
    T1546

    Installer Packages

    1
    T1546.016

    Netsh Helper DLL

    1
    T1546.007

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Impair Defenses

    2
    T1562

    Disable or Modify System Firewall

    1
    T1562.004

    Disable or Modify Tools

    1
    T1562.001

    Modify Registry

    3
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    System Binary Proxy Execution

    1
    T1218

    Msiexec

    1
    T1218.007

    Credential Access

    Discovery

    Network Service Discovery

    1
    T1046

    Peripheral Device Discovery

    2
    T1120

    Query Registry

    4
    T1012

    System Information Discovery

    5
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e57bd38.rbs
      Filesize

      6KB

      MD5

      4c522434ea4137bb356ec2fcf8e80e01

      SHA1

      50505658e8dd47609684dd35294af0afa5f0a287

      SHA256

      c39870f600a34060b9efa1ab9739629507acfd70e5fc91c74ae5b70cb7c878d6

      SHA512

      2c0499623487eef5a25f3029111bde549989154763e3584d5782081c148a49a9e00297021d286b2bdc358bc2feb5e3861af9ef1c97334c14a668d569d0cd305e

      Download Submit

    • C:\Program Files (x86)\1
      Filesize

      6.0MB

      MD5

      a589ea47d27781243203497042014ee3

      SHA1

      02af54d118fdb181247e76a79a3acfbb074bf6ea

      SHA256

      d25b465e1a59b452605512566d4417cb44a72d07b989f8cb276849bf4f66ac52

      SHA512

      baed6eda05efb91f65812e117730bd3d6587166667dc3b7e2f1f3c802a713829b5b6c9c0287fe37267e4a4a5f941776aa49adcbe45ffa1da99e9b73c99b0a09e

      Download Submit

    • C:\Program Files (x86)\Common Files\DsGtQhLH.lnk
      Filesize

      943B

      MD5

      b6f59657ee96050c5aad98a653fe2133

      SHA1

      38b276bc07dfabe9bccf8ffdb6e8e18692135710

      SHA256

      bb1f6c58ba9b0b2fb519310d9ccbb4d8d493d7ea359b6df566dd39dfc023f164

      SHA512

      623d0c22c052ee3bbec6eafeb411a3a43d694c58b4143fef83446f21f4a645fbc2f2763f315299516b0f9b27402f74903ebf6c8ac754262d8b55b5909c1e1d2c

      Download Submit

    • C:\Program Files (x86)\Common Files\DsGtQhLH.lnk~RFe57c2b4.TMP
      Filesize

      898B

      MD5

      eea77b8f53ae7b0034c4ca11c539b652

      SHA1

      399a7618e65ca3b2cb1faf8d32036a3418ee0872

      SHA256

      3b75466e6b8e18156d2e6caf5ff6354b5090b0c8b20202cdc9016c787840565a

      SHA512

      573ac044208714c5d10efefc8b6925e65d7dbf678e6bd5ab6ace446a6d97fed0da2c5c0e9ce2bda807e3b55aaa00b725553919cf5246ee529cdba6892f3bfa0c

      Download Submit

    • C:\Program Files (x86)\DsGtQhLH.exe
      Filesize

      14.5MB

      MD5

      9c44be4ceac0c983a812fd8459511fd0

      SHA1

      bd5aaad4acd523cd2855e8b50a8380365d81e041

      SHA256

      b6750a3631413d71d7ea10292a11e5d0560afb6ccd4ad4baa75d7dc80842f153

      SHA512

      372ddeb1045d49e8f98f17bccffb0e3edc2179e541f8a4493300517327e514c7bf64557250e0f84f7366310a3d7a58a8d5480596f9be075b3f5d9411a49b4d09

      Download Submit

    • C:\Program Files (x86)\MSVCP100.dll
      Filesize

      412KB

      MD5

      ed40615aa67499e2d2da8389ba9b331a

      SHA1

      09780d2c9d75878f7a9bb94599f3dc9386cf3789

      SHA256

      cd28daeda3c8731030e2077e6eccbb609e2098919b05ff310bef8dce1dce2d8d

      SHA512

      47d94c5f4829a0f901b57084c22b24adefb4aec2f7b8df9ea838e485dbc607aa837ed6d3c7186159499c44a3ff488fb04f770c624649a406854d82cd3baf72ee

      Download Submit

    • C:\Program Files (x86)\MSVCR100.dll
      Filesize

      756KB

      MD5

      ef3e115c225588a680acf365158b2f4a

      SHA1

      ecda6d3b4642d2451817833b39248778e9c2cbb0

      SHA256

      25d1cc5be93c7a0b58855ad1f4c9df3cfb9ec87e5dc13db85b147b1951ac6fa8

      SHA512

      d51f51336b7a34eb6c8f429597c3d685eb53853ee5e9d4857c40fc7be6956f1b8363d8d34bebad15ccceae45a6eb69f105f2df6a672f15fb0e6f8d0bb1afb91a

      Download Submit

    • C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
      Filesize

      318B

      MD5

      b34636a4e04de02d079ba7325e7565f0

      SHA1

      f32c1211eac22409bb195415cb5a8063431f75cd

      SHA256

      a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

      SHA512

      6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

      Download Submit

    • C:\Program Files (x86)\letsvpn\LetsPRO.exe
      Filesize

      240KB

      MD5

      ea9e2f517b1cc2dbe7f78302dd7fb593

      SHA1

      cb326eeee062bfc20be4d07fa989b001811fc03c

      SHA256

      b1037f963c91ab0f586349d5aede8e25686784f46f031dfc422e0d69a9939f48

      SHA512

      d8d38e5243ff8f8e3f790c3587bf0360afd7dd185886da86ad7ad6111eed121e91eca18bac9563ea4e6984c46f88639f58a2073884567ca982383ec2cf32f0eb

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\CommunityToolkit.Mvvm.dll
      Filesize

      109KB

      MD5

      983f5c1a6f9f50046521d5e393db6527

      SHA1

      80da035f9d297d541e76ef2ec888e337c1a1291c

      SHA256

      4cdd18ea19e997bd83ac7af716f7e371a84814cb631a5271e3ffad7c08b83080

      SHA512

      8792e61bdacacd49dbb42cba5f1da33e92dc3aecfe9ce06727833565e570c3025dec08d94d88088a8002d73d401de61d9c1ee9cf2752024696853c5e0e01419f

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe
      Filesize

      1.4MB

      MD5

      38973dbbfad9619fde39fab919eb9a04

      SHA1

      09c0b7ec430092c41a576565d8cf8e9df40e12fe

      SHA256

      e7806cd45b774d640bfd1f92e0893d28b87117a9dc25edb490da4449d57ca8ac

      SHA512

      fed73ef38f0008ab93589a6f525866a3f73ce9b090e41482dc4933dadc6f1bce1a26990e8f44704e934528d71e6887d0d44bb38f8b5402cf4c9b2880f16eea67

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\LetsPRO.exe.config
      Filesize

      22KB

      MD5

      3b1d12693ee14f307d7e8b1f08ae23c0

      SHA1

      82719e54b457a4e5cc57b33714e67fc0305b6e90

      SHA256

      0b2a37670105e8d30fe0c4aecfad876f669663834a6c91bc89e309fb609032b7

      SHA512

      ac7b99e0fb2e7d656dfc8e5df1fad58e4446c854e6d1d05a48dbd5fe93ab4978c3b206d828d8bcfc874eff0981886be4ae72e063aaccf895959d7cd5456a5e95

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\LetsVPNDomainModel.dll
      Filesize

      21KB

      MD5

      aaf315462a2bfc476f2488349b629b09

      SHA1

      1957786412810c8200393f329925bf7f8fcb9fa0

      SHA256

      af1328e99850c6a0f309b582c451e16aec5b8446a57617198c96f353f7ba60be

      SHA512

      ff1b9590653e1333f3031456d70169e789bedf7a3a7b9c69f9076b99d080d6d6006e2812c831b603972445b097a1003f7fb84fc34cabf4ee97ba10cd09140b4b

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\Newtonsoft.Json.dll
      Filesize

      693KB

      MD5

      4aba39e3b609f3e927d4b4c850a1e9c2

      SHA1

      2fc88fdfe44f49567a4160fc7ceba175bbe851b3

      SHA256

      abf8133f5bda0aa4700b7b4b9a8f4a6e2af8f9fc38def6ebbec7045fda493671

      SHA512

      cdd79270d8e0e7999b899d32fc012e0450d65732b68eba982b91f213e6550d5568239eb29267adefbd61ea4e674c1096d04a1a6cbbf67fd51e6d8b8ab2770f07

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\Utils.dll
      Filesize

      126KB

      MD5

      d615a49b867921d097b87f5653d06da8

      SHA1

      9475f5bd2517a71d68388f04a247725814bb0a39

      SHA256

      ca0a071afff810cae52cce1def9456d4ddb8ca1a165a4b0aae16951a6f337542

      SHA512

      1986d66a9638d0cc998ee0534fe9443a41f8988aca226770934c5a9b7157931ec8c456ff0034ec63ef32da842d6bae31d97003ab5d65f3a7e51c2773dc758cbe

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\log4net.config
      Filesize

      3KB

      MD5

      28f9077c304d8c626554818a5b5f3b3a

      SHA1

      a01f735fe348383795d61aadd6aab0cc3a9db190

      SHA256

      746b5675ea85c21ef4fcc05e072383a7f83c5fe06aaa391fc3046f34b9817c90

      SHA512

      485c175bc13c64601b15243daecbf72621883c2ff294852c9bbb2681937f7ef0bea65361e0f83131ec989432326442ef387c1ccf2a7ca537c6788b8fd5c0021e

      Download Submit

    • C:\Program Files (x86)\letsvpn\app-3.8.0\log4net.dll
      Filesize

      273KB

      MD5

      e281f008a6d29ae21e0173c97e63ef93

      SHA1

      21004cd1d373563298738bdb70f66dca3865c0bd

      SHA256

      146c386529e15c58ca7cb51927616b8310c7ca0855603bc22addbbcdd9502c11

      SHA512

      b8cebc8bbf18aa03872dc74dbab9569682c64dd5c2ad3c07e542ba08bdb1cccfc5a956622daa1c9e218f8d54b9e26b8533091c378b6f386e25f3fccbdc201765

      Download Submit

    • C:\Program Files (x86)\letsvpn\driver\OemVista.inf
      Filesize

      7KB

      MD5

      26009f092ba352c1a64322268b47e0e3

      SHA1

      e1b2220cd8dcaef6f7411a527705bd90a5922099

      SHA256

      150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

      SHA512

      c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

      Download Submit

    • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
      Filesize

      99KB

      MD5

      1e3cf83b17891aee98c3e30012f0b034

      SHA1

      824f299e8efd95beca7dd531a1067bfd5f03b646

      SHA256

      9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f

      SHA512

      fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b

      Download Submit

    • C:\Program Files (x86)\libcurl.dll
      Filesize

      19.4MB

      MD5

      9ff980feb6fccdb08ab3fe6fc5e428f1

      SHA1

      3c60d0fa914291da59a3cc883becd0ea26c1f26a

      SHA256

      d0cdc6b3747195a88b6918926f488215396970aa342e14d6ea819919d274a381

      SHA512

      989d76d721963f46386350c08b4e7a50a52e16d9fc92bc13c7f1fa20997a9aa35a8f144564af9f483b0e3f2fd32d436adfa84cb8638e9c408a79960b6da38618

      Download Submit

    • C:\Program Files (x86)\pYkYZuRh.exe
      Filesize

      129KB

      MD5

      7ea6be30e745e9556c017439c5e83273

      SHA1

      4e36ae4f8bb1c6a438f8cc6952ec840415b5d9f2

      SHA256

      5a3e4e68ffa8e8796ec0ff3d01473ceafa070dc533a1c268d073ee7abd6c8021

      SHA512

      0a17f4e6e60932282cb28823a77c5ebef7a8c8ee472f00c9ef9eebb0481886647faa698f2c2e193db095c6467f6e41307aff96030fadd3072ba700c1e1e45724

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
      Filesize

      1KB

      MD5

      33b19d75aa77114216dbc23f43b195e3

      SHA1

      36a6c3975e619e0c5232aa4f5b7dc1fec9525535

      SHA256

      b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

      SHA512

      676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      12KB

      MD5

      54687e41cc8f3950a64cce1bf67ba3f6

      SHA1

      7964701932e187601dc9b6c649f48661c7a4290b

      SHA256

      ec99b9618e6c70ad30df062f82396f38d6226a9db50486f7af53b24c9335f00a

      SHA512

      d13f5bef8c9e12c8b7f0fd4c7ee1133a4821c7eaab3a4697babba66c495112ca50771d427fe414e62e1340ea0c46205aff0c5c50199ec99acb56089ca0bae653

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d0bjmokv.kzs.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nslC768.tmp\System.dll
      Filesize

      11KB

      MD5

      75ed96254fbf894e42058062b4b4f0d1

      SHA1

      996503f1383b49021eb3427bc28d13b5bbd11977

      SHA256

      a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

      SHA512

      58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nslC768.tmp\modern-wizard.bmp
      Filesize

      51KB

      MD5

      7f8e1969b0874c8fb9ab44fc36575380

      SHA1

      3057c9ce90a23d29f7d0854472f9f44e87b0f09a

      SHA256

      076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd

      SHA512

      7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nslC768.tmp\nsDialogs.dll
      Filesize

      9KB

      MD5

      ca95c9da8cef7062813b989ab9486201

      SHA1

      c555af25df3de51aa18d487d47408d5245dba2d1

      SHA256

      feb6364375d0ab081e9cdf11271c40cb966af295c600903383b0730f0821c0be

      SHA512

      a30d94910204d1419c803dc12d90a9d22f63117e4709b1a131d8c4d5ead7e4121150e2c8b004a546b33c40c294df0a74567013001f55f37147d86bb847d7bbc9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\nslC768.tmp\nsExec.dll
      Filesize

      6KB

      MD5

      3d366250fcf8b755fce575c75f8c79e4

      SHA1

      2ebac7df78154738d41aac8e27d7a0e482845c57

      SHA256

      8bdd996ae4778c6f829e2bcb651c55efc9ec37eeea17d259e013b39528dddbb6

      SHA512

      67d2d88de625227ccd2cb406b4ac3a215d1770d385c985a44e2285490f49b45f23ce64745b24444e2a0f581335fda02e913b92781043e8dfd287844435ba9094

      Download Submit

    • C:\Windows\Installer\MSIBF2A.tmp
      Filesize

      408KB

      MD5

      0901970c2066aed8a97d75aaf1fd3146

      SHA1

      f0c700a4bfcebad9843e01a88bab71b5f38996d8

      SHA256

      41f827e6addfc71d68cd4758336edf602349fb1230256ec135121f95c670d773

      SHA512

      00e12fd2d752a01dfa75550ffaf3a2f337171cec93cd013083c37137a455e93bebd72e7d8487ec3e1de5fe22994f058829a6597765612278c20d601192cbe733

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      24.1MB

      MD5

      0094a32ee83bffe8bdd2289cf24051d1

      SHA1

      d89e67315365bc5b5d678d6cd879c9300e39b218

      SHA256

      07cab087bdc39201c02a584fb309eff2da1200f334ce689bb15716777a8be4cd

      SHA512

      b67af792f3c82b4624bc97d540ce1435f894cd56c43f74c4c0c32df849f2779ab1432880ae9fcfd69eba7b1bc905aa865b1f63df117d70cc06049da847c06686

      Download Submit

    • \??\Volume{f0eec59f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{0e117936-65a8-4c1b-b2f1-f87e24cd78a8}_OnDiskSnapshotProp
      Filesize

      6KB

      MD5

      cd153a02674779cfcab5ee38b82af75b

      SHA1

      df1970d8acf1fc712ab2131c52d32674068dbfc8

      SHA256

      2992ec593927c05b20024e67c3b58706b5559080f51c0a81f36ba6afe4b57ab8

      SHA512

      8073b3ac6d6ec2db3971a8e0dc903219ab1fe79e511a377853b126cc4058e2aeb1b79c4b17aae6282dc6373bd9d4a26a7a9dbd77269fc75589d2be53d9ee90e3

      Download Submit

    • \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
      Filesize

      38KB

      MD5

      c10ccdec5d7af458e726a51bb3cdc732

      SHA1

      0553aab8c2106abb4120353360d747b0a2b4c94f

      SHA256

      589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

      SHA512

      7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

      Download Submit

    • \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
      Filesize

      10KB

      MD5

      f73ac62e8df97faf3fc8d83e7f71bf3f

      SHA1

      619a6e8f7a9803a4c71f73060649903606beaf4e

      SHA256

      cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

      SHA512

      f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

      Download Submit

    • memory/964-777-0x0000000036030000-0x0000000036042000-memory.dmp

      Filesize

      72KB

      Download

    • memory/964-774-0x0000000035CD0000-0x0000000035CE2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/964-841-0x000000006CC20000-0x000000006D687000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/964-840-0x000000006CC20000-0x000000006D687000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/964-839-0x000000006CC20000-0x000000006D687000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/964-838-0x000000006CC20000-0x000000006D687000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/964-735-0x0000000006240000-0x000000000676C000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/964-835-0x000000006CC20000-0x000000006D687000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/964-834-0x000000006CC20000-0x000000006D687000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/964-833-0x000000006CC20000-0x000000006D687000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/964-831-0x000000006CC20000-0x000000006D687000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/964-823-0x00000000376A0000-0x00000000376D2000-memory.dmp

      Filesize

      200KB

      Download

    • memory/964-816-0x0000000038D90000-0x0000000038DA1000-memory.dmp

      Filesize

      68KB

      Download

    • memory/964-815-0x000000003A2A0000-0x000000003A343000-memory.dmp

      Filesize

      652KB

      Download

    • memory/964-797-0x0000000038E70000-0x0000000038FF6000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/964-796-0x00000000382F0000-0x000000003833C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/964-795-0x0000000037F50000-0x0000000037F9A000-memory.dmp

      Filesize

      296KB

      Download

    • memory/964-785-0x000000006CC20000-0x000000006D687000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/964-784-0x0000000037B00000-0x0000000037B76000-memory.dmp

      Filesize

      472KB

      Download

    • memory/964-783-0x0000000030E10000-0x0000000030E20000-memory.dmp

      Filesize

      64KB

      Download

    • memory/964-782-0x0000000036B20000-0x0000000036B36000-memory.dmp

      Filesize

      88KB

      Download

    • memory/964-781-0x0000000030E00000-0x0000000030E10000-memory.dmp

      Filesize

      64KB

      Download

    • memory/964-778-0x0000000036BE0000-0x0000000036BFE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/964-775-0x0000000035CF0000-0x0000000035D04000-memory.dmp

      Filesize

      80KB

      Download

    • memory/964-776-0x0000000035CC0000-0x0000000035CC8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/964-742-0x0000000006190000-0x0000000006198000-memory.dmp

      Filesize

      32KB

      Download

    • memory/964-773-0x0000000035CA0000-0x0000000035CA8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/964-736-0x0000000005FD0000-0x0000000005FF2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/964-770-0x00000000360C0000-0x0000000036664000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/964-766-0x00000000325D0000-0x00000000325DE000-memory.dmp

      Filesize

      56KB

      Download

    • memory/964-765-0x00000000325F0000-0x0000000032628000-memory.dmp

      Filesize

      224KB

      Download

    • memory/964-716-0x0000000000620000-0x000000000078E000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/964-720-0x0000000004F50000-0x0000000004F74000-memory.dmp

      Filesize

      144KB

      Download

    • memory/964-759-0x0000000034700000-0x0000000034708000-memory.dmp

      Filesize

      32KB

      Download

    • memory/964-728-0x0000000004FC0000-0x0000000004FCA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/964-750-0x00000000309F0000-0x0000000030A82000-memory.dmp

      Filesize

      584KB

      Download

    • memory/964-724-0x00000000053C0000-0x0000000005406000-memory.dmp

      Filesize

      280KB

      Download

    • memory/964-747-0x000000002FBB0000-0x000000002FBC0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/964-746-0x000000002FBE0000-0x000000002FC06000-memory.dmp

      Filesize

      152KB

      Download

    • memory/964-745-0x000000002FB80000-0x000000002FB8A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/964-733-0x0000000005700000-0x00000000057B2000-memory.dmp

      Filesize

      712KB

      Download

    • memory/964-734-0x00000000057C0000-0x0000000005B14000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/964-837-0x000000006CC20000-0x000000006D687000-memory.dmp

      Filesize

      10.4MB

      Download

    • memory/964-744-0x00000000061D0000-0x00000000061DA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/964-743-0x00000000061B0000-0x00000000061BA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/964-738-0x0000000006140000-0x000000000615E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/964-739-0x0000000006160000-0x000000000617A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/964-740-0x00000000061A0000-0x00000000061AA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/964-741-0x00000000061E0000-0x0000000006206000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2188-123-0x0000000004070000-0x00000000040A8000-memory.dmp

      Filesize

      224KB

      Download

    • memory/2188-107-0x0000000004720000-0x0000000005047000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/2188-124-0x0000000004070000-0x00000000040A8000-memory.dmp

      Filesize

      224KB

      Download

    • memory/2188-128-0x0000000004070000-0x00000000040A8000-memory.dmp

      Filesize

      224KB

      Download

    • memory/2188-127-0x0000000004070000-0x00000000040A8000-memory.dmp

      Filesize

      224KB

      Download

    • memory/2188-535-0x0000000004720000-0x0000000005047000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/2188-120-0x0000000004720000-0x0000000005047000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/2188-117-0x0000000004720000-0x0000000005047000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/2188-115-0x0000000004720000-0x0000000005047000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/2188-121-0x0000000004720000-0x0000000005047000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/2188-102-0x0000000001060000-0x0000000001061000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2188-122-0x0000000004720000-0x0000000005047000-memory.dmp

      Filesize

      9.2MB

      Download

    • memory/2188-103-0x0000000001070000-0x0000000001071000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2188-104-0x0000000010000000-0x0000000011E5A000-memory.dmp

      Filesize

      30.4MB

      Download

    • memory/4584-73-0x0000000004780000-0x00000000047B6000-memory.dmp

      Filesize

      216KB

      Download

    • memory/4584-89-0x0000000005DE0000-0x0000000005E2C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/4584-74-0x0000000004DF0000-0x0000000005418000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/4584-75-0x0000000004D60000-0x0000000004D82000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4584-76-0x0000000005650000-0x00000000056B6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4584-82-0x0000000005730000-0x0000000005796000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4584-87-0x00000000058E0000-0x0000000005C34000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/4584-88-0x0000000005D90000-0x0000000005DAE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/5092-584-0x00000000070A0000-0x00000000070D2000-memory.dmp

      Filesize

      200KB

      Download

    • memory/5092-582-0x0000000006150000-0x000000000619C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/5092-605-0x0000000007640000-0x0000000007648000-memory.dmp

      Filesize

      32KB

      Download

    • memory/5092-585-0x000000006FAA0000-0x000000006FAEC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/5092-595-0x0000000006650000-0x000000000666E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/5092-598-0x00000000073C0000-0x00000000073DA000-memory.dmp

      Filesize

      104KB

      Download

    • memory/5092-596-0x00000000072E0000-0x0000000007383000-memory.dmp

      Filesize

      652KB

      Download

    • memory/5092-597-0x0000000007A10000-0x000000000808A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/5092-599-0x0000000007440000-0x000000000744A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/5092-576-0x0000000005AF0000-0x0000000005E44000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/5092-600-0x0000000007650000-0x00000000076E6000-memory.dmp

      Filesize

      600KB

      Download

    • memory/5092-601-0x00000000075C0000-0x00000000075D1000-memory.dmp

      Filesize

      68KB

      Download

    • memory/5092-602-0x00000000075F0000-0x00000000075FE000-memory.dmp

      Filesize

      56KB

      Download

    • memory/5092-603-0x0000000007600000-0x0000000007614000-memory.dmp

      Filesize

      80KB

      Download

    • memory/5092-604-0x0000000007710000-0x000000000772A000-memory.dmp

      Filesize

      104KB

      Download