Overview

overview

10

Static

static

3

kuai.exe

windows7-x64

10

kuai.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 05:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    kuai.exe

  • Size

    31.4MB

  • MD5

    bb1058c71041096a14109e59bdcb4e5f

  • SHA1

    0ad3510e1e0f1e01fdd645e114f8ce743b1aed1b

  • SHA256

    ac4e2d438500d0cd21f3fc269b37123dcd8c732bcf945b716b29643c411f4089

  • SHA512

    f25a6cd4b741f33f10f06fad324d93b48013ffcfcb850fa50971b1b76bde381007b8bf5b0b736569ac5661e49a3e8d54b308f8f09dfbc8540b9911ee71ded99b

  • SSDEEP

    393216:ysFBi0lwDQi8oo4zAQUi+9U8TEFzSVy6vbBYShIL6DNBjuy1K+HAfHiF3v:y+BBuEidD98TE8s6NzpS/Q

Score
10/10
discoveryevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    evasion
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 22 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 13 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\kuai.exe
    "C:\Users\Admin\AppData\Local\Temp\kuai.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ipconfig /all
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\system32\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:2980
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" -f C:\ProgramData\4NTJa.xml
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:2840
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\7bDDU.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
        3⤵
        • UAC bypass
        PID:2852
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
        3⤵
        • UAC bypass
        PID:2764
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
        3⤵
        • UAC bypass
        PID:2828
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\8iVy2\0Xs71~16\s+C:\ProgramData\8iVy2\0Xs71~16\a C:\ProgramData\8iVy2\0Xs71~16\DuiLib.dll
      2⤵
        PID:2780
    • C:\Windows\system32\mmc.exe
      C:\Windows\system32\mmc.exe -Embedding
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\ProgramData\8iVy2\0Xs71~16\WXWorkUpdate.exe
        "C:\ProgramData\8iVy2\0Xs71~16\WXWorkUpdate.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2928
    • C:\Windows\system32\mmc.exe
      C:\Windows\system32\mmc.exe -Embedding
      1⤵
      • Suspicious behavior: SetClipboardViewer
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1736
      • C:\ProgramData\letsvpn-latest.exe
        "C:\ProgramData\letsvpn-latest.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
          3⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3040
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
          3⤵
          • Executes dropped EXE
          PID:1480
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          PID:2588
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=lets
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2304
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=lets
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2236
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=lets.exe
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2832
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=lets.exe
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2840
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3000
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsPRO.exe
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2712
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3016
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsPRO
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1092
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2688
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsVPN
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1580
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
          3⤵
          • Executes dropped EXE
          PID:568
        • C:\Program Files (x86)\letsvpn\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2944
          • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
            "C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2416
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C netsh interface ipv4 set interface LetsTAP metric=1
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2480
              • C:\Windows\SysWOW64\netsh.exe
                netsh interface ipv4 set interface LetsTAP metric=1
                6⤵
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:2120
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C ipconfig /all
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1532
              • C:\Windows\SysWOW64\ipconfig.exe
                ipconfig /all
                6⤵
                • System Location Discovery: System Language Discovery
                • Gathers network information
                PID:2228
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C route print
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2616
              • C:\Windows\SysWOW64\ROUTE.EXE
                route print
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1600
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C arp -a
              5⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:2548
              • C:\Windows\SysWOW64\ARP.EXE
                arp -a
                6⤵
                • Network Service Discovery
                • System Location Discovery: System Language Discovery
                PID:1664
            • C:\Windows\SysWOW64\netsh.exe
              C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
              5⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:2684
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4071ca87-112d-50d9-78f9-5b1a85f24557}\oemvista.inf" "9" "6d14a44ff" "00000000000003B8" "WinSta0\Default" "00000000000005DC" "208" "c:\program files (x86)\letsvpn\driver"
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2860
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{236f3b49-105e-4df3-166a-5b2cd43a9d30} Global\{47bbe31d-3c76-24c0-a015-2023fcb3922f} C:\Windows\System32\DriverStore\Temp\{63840dd4-dcd5-14f1-766c-3406775e4128}\oemvista.inf C:\Windows\System32\DriverStore\Temp\{63840dd4-dcd5-14f1-766c-3406775e4128}\tap0901.cat
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2576
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2872
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005E8" "00000000000005FC"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2472
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:tap0901.NTamd64:tap0901.ndi:9.24.6.601:tap0901" "6d14a44ff" "00000000000003B8" "00000000000005A0" "0000000000000608"
      1⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1300
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:1548

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      2
      T1059

      PowerShell

      1
      T1059.001

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      2
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Disable or Modify Tools

      1
      T1562.001

      Modify Registry

      3
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Credential Access

      Discovery

      Network Service Discovery

      1
      T1046

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe.config
        Filesize

        26KB

        MD5

        6126a1ab971d6bd4761f45791af90b1e

        SHA1

        36013821807f6fe08fe3b60a22ec519fd3e5579c

        SHA256

        9b7b7ec30f305b3cd9da40662f95ed57ae89ed8afd2b11d26503e387ff3c262d

        SHA512

        9f74f9f4ad593980337099717ba1e6b584530ee0e192b137297961d1550a70ae3a30fc1bf3e6e670fb817682354648d610f2a542b753a61f397ccaca20908510

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\OemVista.inf
        Filesize

        7KB

        MD5

        26009f092ba352c1a64322268b47e0e3

        SHA1

        e1b2220cd8dcaef6f7411a527705bd90a5922099

        SHA256

        150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

        SHA512

        c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

        Download Submit

      • C:\ProgramData\8iVy2\0Xs71~16\DuiLib.dll
        Filesize

        2.3MB

        MD5

        3fe2756032dd2b102b5aedc719b46d10

        SHA1

        1b8d2b21350f9bfe270b12d77a9f793f5eecead2

        SHA256

        03c2632bc7ae92e409c063e4f260b1a7199ff6cdd7ba0b0455fd1947afe79b99

        SHA512

        800c62ea9d22c3d044de0497775b4f9a72a360ee0e4c222e267453b7d9cf7f90754689988c684aabdcffa8f245e9e9a48a2616f22a5cccfb11e06ad70b3160ae

        Download Submit

      • C:\ProgramData\8iVy2\0Xs71~16\SK.txt
        Filesize

        204KB

        MD5

        108f9300c28d82bcd7cedc8769e91be6

        SHA1

        bbd6ab51e82887e8c8b0cf1a9e55a84078075100

        SHA256

        e7220fe3d5e1eb97584f88e0d25af27a018d748100b3f840c697b71c1037b238

        SHA512

        bb7f7d6a483cb01cf69895eba967d2a3b10d4af430c1d2ff0c16f5d3194a279fe525bf344d964d44c1c16ff9df79ffcee1d4ebf28f838909eccf948dc5d70703

        Download Submit

      • C:\ProgramData\8iVy2\0Xs71~16\WXWorkUpdate.exe
        Filesize

        1.2MB

        MD5

        919845c9609f79ce1927249ec6d541c2

        SHA1

        f7fb946e5895ec3aecdd25e5403ea10374744bc0

        SHA256

        9843402d481a895f2f43601e2bf7164eb5589f583f9b58978c61677eb17e0990

        SHA512

        c612f0507790fca918eab7e34817a51ae3bc935a15b200b659c1cc8aeaf9c97cfbc1203d921fe38eedc402c3b1d8f88998f8f39dbf25e845139738d50a945092

        Download Submit

      • C:\ProgramData\8iVy2\0Xs71~16\a
        Filesize

        1.2MB

        MD5

        2e9d70be56fa937fbc8d342997a3813b

        SHA1

        3adce5be09b0924ba7f4e02444c9f19027e0eca3

        SHA256

        7388e270cc163022c540650f08823825be0076a0b25b0e7bc4bdc6319e28cf79

        SHA512

        7c562d88c62f5a4cbf7ba0351e5793b6363439e626e922d81145334a3523eb371f68f9d0ee117e12f055e39d09267442233a735b2a8768bbf5de048c952567d8

        Download Submit

      • C:\ProgramData\8iVy2\0Xs71~16\s
        Filesize

        1.2MB

        MD5

        25e6c245c0b2d8f895be134bd54390d1

        SHA1

        41096adbc64cb7b310f7534dda521b5dec86d994

        SHA256

        0ce06d64d518f0df305711964a2adf8e24eb234ec1c8a2cab6f37c2a04d147bd

        SHA512

        36df8e9877b2cdab0a5dead00fc47cb0a1d3aee44f35424d0f8e776c3d38f9251b36ebee0444989089ba22eab52d2744f2863fcecce0e3469aee79040da3b55b

        Download Submit

      • C:\ProgramData\letsvpn-latest.exe
        Filesize

        14.7MB

        MD5

        e039e221b48fc7c02517d127e158b89f

        SHA1

        79eed88061472ae590616556f31576ca13bfc7fb

        SHA256

        dc30e5dab15392627d30a506f6304030c581fc00716703fc31add10ff263d70b

        SHA512

        87231c025bb94771e89a639c9cb1528763f096059f8806227b8ab45a8f1ea5cd3d94fdc91cb20dd140b91a14904653517f7b6673a142a864a58a2726d14ae4b8

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
        Filesize

        1KB

        MD5

        a266bb7dcc38a562631361bbf61dd11b

        SHA1

        3b1efd3a66ea28b16697394703a72ca340a05bd5

        SHA256

        df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

        SHA512

        0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
        Filesize

        242B

        MD5

        0ee69af232b63531a442a0e4df65ad2b

        SHA1

        c2f41728333bbe807d4729ec5b41cdb2a51b8fcb

        SHA256

        e26490f54a4837bc78d083eeb39e6431e4eb2104ac5b90ff55c849ab28671b18

        SHA512

        ec16b082d0d504abd0f73385b9acdec277ba1587513f7071ec36f46c7d87e99af551367f1ed7552791018a372fcdc226e40f72404f140e89c1a2c988ee1125cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Cab981D.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar983F.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsj3F52.tmp\modern-wizard.bmp
        Filesize

        51KB

        MD5

        7f8e1969b0874c8fb9ab44fc36575380

        SHA1

        3057c9ce90a23d29f7d0854472f9f44e87b0f09a

        SHA256

        076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd

        SHA512

        7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555

        Download Submit

      • C:\Users\Admin\AppData\Roaming\7bDDU.bat
        Filesize

        392B

        MD5

        30d6eb22d6aeec10347239b17b023bf4

        SHA1

        e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

        SHA256

        659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

        SHA512

        500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

        Download Submit

      • C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_neutral_662fd96dfdced4ae\oemvista.PNF
        Filesize

        8KB

        MD5

        a77bad85d8d8bbae7f18809edccf3e3c

        SHA1

        a2696e50d17f2b7f102efe33fc777c89ccba5705

        SHA256

        1ad8b927d83c8e0d7417210eccd466f051f0623c2d41b62d7e7a0c2632015e9a

        SHA512

        8b85da1222e60190e83e6b0e8eef0c182deb243206ad2a6903317cccb4bcde504f84870e90129a7cae0e03175ce7f04c84899bca7cfaf22a9886e15e47bc7f3d

        Download Submit

      • C:\Windows\System32\DriverStore\INFCACHE.1
        Filesize

        1.4MB

        MD5

        40c7520134b29cb89a8341bfa362f0ef

        SHA1

        b9c90622c58096f2168cc1bd81f051b79ca7f7d0

        SHA256

        406f682d74cf7244b2c3d414de2fef03887255ad8e80e33f8b61b4d7393657c8

        SHA512

        90b1446316d63a2063cbd8d008e6445dab2406d4ddfcc37ef0b35d684f1168d7760cae7619257f9c946906b69d39d385cf92c11b62eda61059c082b3723c76c9

        Download Submit

      • C:\Windows\Temp\Cab9B96.tmp
        Filesize

        29KB

        MD5

        d59a6b36c5a94916241a3ead50222b6f

        SHA1

        e274e9486d318c383bc4b9812844ba56f0cff3c6

        SHA256

        a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

        SHA512

        17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

        Download Submit

      • C:\Windows\Temp\Tar9BD7.tmp
        Filesize

        81KB

        MD5

        b13f51572f55a2d31ed9f266d581e9ea

        SHA1

        7eef3111b878e159e520f34410ad87adecf0ca92

        SHA256

        725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

        SHA512

        f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

        Download Submit

      • C:\Windows\inf\oem2.PNF
        Filesize

        8KB

        MD5

        326f95b1ce4061cc83f6981b20b83969

        SHA1

        df3aa2a3506417c76819c6f919885a3addd7feeb

        SHA256

        09a1d3b835e424b9cc2807fb0e5a5168398a30cb7f597d586fcc6c303969ab4b

        SHA512

        05f6de166623fc5bb3d0c9b8402dc6389cc29f1e4cb05a12bb17766da0325e742016d85715037ca4b4faa009ff211f47fdfc27eab09476735cc15a0c1392c571

        Download Submit

      • \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
        Filesize

        30KB

        MD5

        b1c405ed0434695d6fc893c0ae94770c

        SHA1

        79ecacd11a5f2b7e2d3f0461eef97b7b91181c46

        SHA256

        4c474ea37a98899e2997591a5e963f10f7d89d620c74c8ee099d3490f5213246

        SHA512

        635421879cd4c7c069489033afaf7db1641615bfd84e237264acfe3f2d67668ecfe8a9b9edd0e9d35b44dec7d6ba0197ed7048dfb8ec3dba87ccdc88be9acfb7

        Download Submit

      • \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
        Filesize

        9KB

        MD5

        4fee2548578cd9f1719f84d2cb456dbf

        SHA1

        3070ed53d0e9c965bf1ffea82c259567a51f5d5f

        SHA256

        baecd78253fb6fbcfb521131e3570bf655aa9a05bb5610ce8bb4bddccf599b24

        SHA512

        6bc0c8c3757d1e226218a9485a4f9cdbae7ca40b56c35b9ff28c373be9bd6fbd7b1846ddf5680edb2e910d31912791afe2f9f2207b3880b56adb55426fc3fd49

        Download Submit

      • \Program Files (x86)\letsvpn\LetsPRO.exe
        Filesize

        240KB

        MD5

        bd8643e5db648810348aa0755e455b70

        SHA1

        119cb1fb3057d9759d0abb3dfdafc460456c1cc4

        SHA256

        bec6a116ea2224dd1532c6eaf20e4d61199240e55ccd0270199fbd22f2806477

        SHA512

        b8033d8989c66431e1771ffc6d2549a4d1e32b8612b7331e7a2931ddad3e31c8a7e1af8ef129883034b1fcf466b8ad0e1cab431cbf5c20c724f4eef53468f714

        Download Submit

      • \Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
        Filesize

        1.5MB

        MD5

        ca72f8ead2ae568acc481f685385fb60

        SHA1

        887a1d53c8b61c81a80592ff62cf9cdf56b29d18

        SHA256

        d287af28a137d9c015531eae28815d2b0d0a53879318f104ef34e5d86e2c4618

        SHA512

        8da648e1363d490d6a4ee5ec9e38aec86384f345ae5fd58150b2affce8c3c208e1a55598cfe820d00e9448910598ffde29d2824275ebaafaa7d33279898a2e4c

        Download Submit

      • \Program Files (x86)\letsvpn\app-3.11.2\LetsVPNDomainModel.dll
        Filesize

        20KB

        MD5

        85bee1626071af1b07e79fc7963731e4

        SHA1

        d804e63940798891928f3ba29be85cf06fbb9769

        SHA256

        222f84cd3111f90b7ce045119e63678ee180ab0a7c4f48cae25f097ee425debe

        SHA512

        6649931736a607dceea5ec8180e07c14c331761a7dd0fa5ab4187d3302c0a51262ccce40024d6540f3453d8bdd43785c5f8d45e9c5252e097b69b30fced78832

        Download Submit

      • \Program Files (x86)\letsvpn\app-3.11.2\Utils.dll
        Filesize

        126KB

        MD5

        8af72dc9783c52125e229f8b79afba94

        SHA1

        71178bc7cfced6bc5dcb45ed666cdbe2c55182dd

        SHA256

        68ae722154cebfb3a3ca59b135e182a68fa0d6966a089008028f97022849bbc5

        SHA512

        dcada700522b78fe0006e84c6599a9857269512eb65a68c0475635f76d5805c43decad74232eb39dae83f987b3dabafe07129d44cce950c8dc9efd11901599e2

        Download Submit

      • \Program Files (x86)\letsvpn\app-3.11.2\log4net.dll
        Filesize

        273KB

        MD5

        5b9a663d7584d8e605b0c39031ec485a

        SHA1

        b7d86ebe4e18cb6d2a48a1c97ac6f7e39c8a9b91

        SHA256

        e45afce6eff080d568e3e059498f5768585143336c600011273366905f4fc635

        SHA512

        b02bd950384cf3d656c4b8f590013392e3028c6183aa9321bd91b6fc1f5d41b03771313ca5e3305398a60642fa14fc5a98daf3e6decba586c80861bafcbf0c64

        Download Submit

      • \Program Files (x86)\letsvpn\driver\tapinstall.exe
        Filesize

        99KB

        MD5

        1e3cf83b17891aee98c3e30012f0b034

        SHA1

        824f299e8efd95beca7dd531a1067bfd5f03b646

        SHA256

        9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f

        SHA512

        fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b

        Download Submit

      • \ProgramData\8iVy2\0Xs71~16\msvcp140.dll
        Filesize

        429KB

        MD5

        cfbdf284c12056347e6773cb3949fbba

        SHA1

        ad3fa5fbbc4296d4a901ea94460762faf3d6a2b8

        SHA256

        bbecdfda2551b01aa16005c88305982c360a9fb9ba3d9be2fb15f2e9c6eb809f

        SHA512

        2f24eac94d51f8f28c8e6b6234ca2e481e0f8f1a73df62766ff4f5640480377fb2c4a469babedb87d303503994b469e570aaf725e16da6f9b2d6a77f15b4623f

        Download Submit

      • \ProgramData\8iVy2\0Xs71~16\vcruntime140.dll
        Filesize

        81KB

        MD5

        8e65e033799eb9fd46bc5c184e7d1b85

        SHA1

        e1cc5313be1f7df4c43697f8f701305585fe4e71

        SHA256

        be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4

        SHA512

        e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd

        Download Submit

      • \Users\Admin\AppData\Local\Temp\nsj3F52.tmp\System.dll
        Filesize

        12KB

        MD5

        192639861e3dc2dc5c08bb8f8c7260d5

        SHA1

        58d30e460609e22fa0098bc27d928b689ef9af78

        SHA256

        23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

        SHA512

        6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

        Download Submit

      • \Users\Admin\AppData\Local\Temp\nsj3F52.tmp\nsDialogs.dll
        Filesize

        9KB

        MD5

        b7d61f3f56abf7b7ff0d4e7da3ad783d

        SHA1

        15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

        SHA256

        89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

        SHA512

        6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

        Download Submit

      • \Users\Admin\AppData\Local\Temp\nsj3F52.tmp\nsExec.dll
        Filesize

        7KB

        MD5

        11092c1d3fbb449a60695c44f9f3d183

        SHA1

        b89d614755f2e943df4d510d87a7fc1a3bcf5a33

        SHA256

        2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

        SHA512

        c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

        Download Submit

      • memory/1300-745-0x0000000000BB0000-0x0000000000BD6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2416-819-0x0000000005670000-0x000000000567A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2416-958-0x000000000E590000-0x000000000E5A2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2416-801-0x00000000020B0000-0x00000000020D4000-memory.dmp

        Filesize

        144KB

        Download

      • memory/2416-1515-0x000000006BEB0000-0x000000006C918000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/2416-1316-0x000000006BEB0000-0x000000006C918000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/2416-805-0x00000000020E0000-0x0000000002126000-memory.dmp

        Filesize

        280KB

        Download

      • memory/2416-1315-0x000000006BEB0000-0x000000006C918000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/2416-810-0x0000000000390000-0x000000000039A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2416-811-0x0000000005160000-0x0000000005212000-memory.dmp

        Filesize

        712KB

        Download

      • memory/2416-812-0x00000000049A0000-0x00000000049BE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/2416-813-0x00000000049C0000-0x00000000049DA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/2416-814-0x00000000049F0000-0x00000000049FA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2416-815-0x0000000005220000-0x0000000005246000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2416-816-0x00000000047D0000-0x00000000047D8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2416-817-0x0000000004B50000-0x0000000004B5A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2416-818-0x0000000004C60000-0x0000000004C6A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2416-1314-0x000000006BEB0000-0x000000006C918000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/2416-820-0x0000000005B00000-0x0000000005B26000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2416-821-0x00000000057D0000-0x00000000057E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2416-823-0x0000000005C80000-0x0000000005C8A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2416-822-0x0000000005C80000-0x0000000005C8A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2416-797-0x0000000000B20000-0x0000000000CA4000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/2416-957-0x000000000E580000-0x000000000E588000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2416-959-0x000000000E700000-0x000000000E714000-memory.dmp

        Filesize

        80KB

        Download

      • memory/2416-960-0x000000000E760000-0x000000000E768000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2416-961-0x000000002E990000-0x000000002E9A2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2416-970-0x000000002EE10000-0x000000002EE20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2416-975-0x000000002F880000-0x000000002F8DC000-memory.dmp

        Filesize

        368KB

        Download

      • memory/2416-974-0x000000002F400000-0x000000002F410000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2416-973-0x000000002F3E0000-0x000000002F3F6000-memory.dmp

        Filesize

        88KB

        Download

      • memory/2416-976-0x0000000004820000-0x000000000483E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/2416-977-0x000000006BEB0000-0x000000006C918000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/2416-978-0x00000000302D0000-0x0000000030302000-memory.dmp

        Filesize

        200KB

        Download

      • memory/2416-979-0x0000000005C80000-0x0000000005C8A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2416-1092-0x000000006BEB0000-0x000000006C918000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/2904-1-0x0000000180000000-0x0000000180264000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2904-2-0x0000000180000000-0x0000000180264000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2904-19-0x0000000180000000-0x0000000180264000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2904-3-0x0000000180000000-0x0000000180264000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2904-4-0x0000000180000000-0x0000000180264000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2928-29-0x0000000001F90000-0x0000000001FF9000-memory.dmp

        Filesize

        420KB

        Download