Overview

overview

10

Static

static

3

kuai.exe

windows7-x64

10

kuai.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 05:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    kuai.exe

  • Size

    31.4MB

  • MD5

    bb1058c71041096a14109e59bdcb4e5f

  • SHA1

    0ad3510e1e0f1e01fdd645e114f8ce743b1aed1b

  • SHA256

    ac4e2d438500d0cd21f3fc269b37123dcd8c732bcf945b716b29643c411f4089

  • SHA512

    f25a6cd4b741f33f10f06fad324d93b48013ffcfcb850fa50971b1b76bde381007b8bf5b0b736569ac5661e49a3e8d54b308f8f09dfbc8540b9911ee71ded99b

  • SSDEEP

    393216:ysFBi0lwDQi8oo4zAQUi+9U8TEFzSVy6vbBYShIL6DNBjuy1K+HAfHiF3v:y+BBuEidD98TE8s6NzpS/Q

Score
10/10
discoveryevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 63 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 21 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\kuai.exe
    "C:\Users\Admin\AppData\Local\Temp\kuai.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:464
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ipconfig /all
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4068
      • C:\Windows\system32\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:4260
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" -f C:\ProgramData\Gf5hA.xml
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:2116
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\79VtC.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
        3⤵
        • UAC bypass
        PID:4752
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
        3⤵
        • UAC bypass
        PID:2468
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
        3⤵
        • UAC bypass
        PID:4976
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\JyNor\L60z9~16\s+C:\ProgramData\JyNor\L60z9~16\a C:\ProgramData\JyNor\L60z9~16\DuiLib.dll
      2⤵
        PID:3692
    • C:\Windows\system32\mmc.exe
      C:\Windows\system32\mmc.exe -Embedding
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\ProgramData\JyNor\L60z9~16\WXWorkUpdate.exe
        "C:\ProgramData\JyNor\L60z9~16\WXWorkUpdate.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4072
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ipconfig /all
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5020
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            4⤵
            • System Location Discovery: System Language Discovery
            • Gathers network information
            PID:3640
    • C:\Windows\system32\mmc.exe
      C:\Windows\system32\mmc.exe -Embedding
      1⤵
      • Suspicious behavior: SetClipboardViewer
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\ProgramData\letsvpn-latest.exe
        "C:\ProgramData\letsvpn-latest.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4416
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2696
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          PID:4428
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:644
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=lets
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:996
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=lets
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2688
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=lets.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2320
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=lets.exe
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3552
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2148
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsPRO.exe
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2696
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:456
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsPRO
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4428
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2856
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsVPN
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3364
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          PID:2704
        • C:\Program Files (x86)\letsvpn\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2328
          • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
            "C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:4976
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C ipconfig /all
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2544
              • C:\Windows\SysWOW64\ipconfig.exe
                ipconfig /all
                6⤵
                • System Location Discovery: System Language Discovery
                • Gathers network information
                PID:3228
            • C:\Windows\SysWOW64\netsh.exe
              C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
              5⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:3576
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C route print
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3708
              • C:\Windows\SysWOW64\ROUTE.EXE
                route print
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4952
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C arp -a
              5⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1388
              • C:\Windows\SysWOW64\ARP.EXE
                arp -a
                6⤵
                • Network Service Discovery
                • System Location Discovery: System Language Discovery
                PID:2696
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{cb32a8fd-0f86-6a42-be68-ec357b229648}\oemvista.inf" "9" "4d14a44ff" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\letsvpn\driver"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:1960
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "000000000000014C"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:740
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      PID:3752
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:1480

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      2
      T1059

      PowerShell

      1
      T1059.001

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      2
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Disable or Modify Tools

      1
      T1562.001

      Modify Registry

      3
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Credential Access

      Discovery

      Network Service Discovery

      1
      T1046

      Peripheral Device Discovery

      2
      T1120

      Query Registry

      5
      T1012

      System Information Discovery

      6
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
        Filesize

        318B

        MD5

        b34636a4e04de02d079ba7325e7565f0

        SHA1

        f32c1211eac22409bb195415cb5a8063431f75cd

        SHA256

        a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

        SHA512

        6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

        Download Submit

      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        Filesize

        240KB

        MD5

        bd8643e5db648810348aa0755e455b70

        SHA1

        119cb1fb3057d9759d0abb3dfdafc460456c1cc4

        SHA256

        bec6a116ea2224dd1532c6eaf20e4d61199240e55ccd0270199fbd22f2806477

        SHA512

        b8033d8989c66431e1771ffc6d2549a4d1e32b8612b7331e7a2931ddad3e31c8a7e1af8ef129883034b1fcf466b8ad0e1cab431cbf5c20c724f4eef53468f714

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\CommunityToolkit.Mvvm.dll
        Filesize

        109KB

        MD5

        143351606a574d84328219a7c18c7219

        SHA1

        8e47c7b530f40553f4a88daff11d78255cc77730

        SHA256

        cbe3b5714c52ad9ff8885d9893c9ed77ad54485a7c5bae3a75151c06d3ae7c4f

        SHA512

        b4698855a37639cac6dd4c400d11028bba1433f43e811e23881a72f7875048c77cf0dbd8bab8c0374ae7182fe41f37f69f5942d770fbbead86b12805b6647291

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
        Filesize

        1.5MB

        MD5

        ca72f8ead2ae568acc481f685385fb60

        SHA1

        887a1d53c8b61c81a80592ff62cf9cdf56b29d18

        SHA256

        d287af28a137d9c015531eae28815d2b0d0a53879318f104ef34e5d86e2c4618

        SHA512

        8da648e1363d490d6a4ee5ec9e38aec86384f345ae5fd58150b2affce8c3c208e1a55598cfe820d00e9448910598ffde29d2824275ebaafaa7d33279898a2e4c

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe.config
        Filesize

        26KB

        MD5

        6126a1ab971d6bd4761f45791af90b1e

        SHA1

        36013821807f6fe08fe3b60a22ec519fd3e5579c

        SHA256

        9b7b7ec30f305b3cd9da40662f95ed57ae89ed8afd2b11d26503e387ff3c262d

        SHA512

        9f74f9f4ad593980337099717ba1e6b584530ee0e192b137297961d1550a70ae3a30fc1bf3e6e670fb817682354648d610f2a542b753a61f397ccaca20908510

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsVPNDomainModel.dll
        Filesize

        20KB

        MD5

        85bee1626071af1b07e79fc7963731e4

        SHA1

        d804e63940798891928f3ba29be85cf06fbb9769

        SHA256

        222f84cd3111f90b7ce045119e63678ee180ab0a7c4f48cae25f097ee425debe

        SHA512

        6649931736a607dceea5ec8180e07c14c331761a7dd0fa5ab4187d3302c0a51262ccce40024d6540f3453d8bdd43785c5f8d45e9c5252e097b69b30fced78832

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\Newtonsoft.Json.dll
        Filesize

        693KB

        MD5

        33a3c1df70cfab1888a4b20565515f81

        SHA1

        c1bfab7454dda45074a6e2b9ae4e9a2712830af6

        SHA256

        0c3c293507c487b76021baaded76defb0fecaf01c1327a448a9b756987595a9e

        SHA512

        76d3e0c34c5e793283910f93af3693355abdd374cf50234496cf3bbebf82a381113fbb4d53ad469f2f5a001b2cb96c761310a3825f8973ae61a4e8b59061cb28

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\System.Runtime.InteropServices.RuntimeInformation.dll
        Filesize

        21KB

        MD5

        2a27f887342305cecd5ba36c8dbd4267

        SHA1

        2ca43487e37a67824b071d2870765f26c33ef7f2

        SHA256

        26a04bc90979886d477bb9777545e75a65c5f67443fdb5185c2fea249afc882b

        SHA512

        8d25ed902e2ca4191118b75cae0ea6338d0ce6aac3d10c08288e802704a115b15988a764899f3368aca0e7798933c5d4925721d82d7a7228372f435a36e1eafe

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\Utils.dll
        Filesize

        126KB

        MD5

        8af72dc9783c52125e229f8b79afba94

        SHA1

        71178bc7cfced6bc5dcb45ed666cdbe2c55182dd

        SHA256

        68ae722154cebfb3a3ca59b135e182a68fa0d6966a089008028f97022849bbc5

        SHA512

        dcada700522b78fe0006e84c6599a9857269512eb65a68c0475635f76d5805c43decad74232eb39dae83f987b3dabafe07129d44cce950c8dc9efd11901599e2

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\log4net.config
        Filesize

        1KB

        MD5

        7a7521bc7f838610905ce0286324ce39

        SHA1

        8ab90dd0c4b6edb79a6af2233340d0f59e9ac195

        SHA256

        2a322178557c88cc3c608101e8fc84bfd2f8fa9b81483a443bb3d09779de218d

        SHA512

        b25dfdce0977eaf7159df5eabe4b147a6c0adac39c84d1c7a9fe748446a10c8d2e20d04cf36221057aa210633df65f2a460821c8c79a2db16c912ec53a714d83

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\log4net.dll
        Filesize

        273KB

        MD5

        5b9a663d7584d8e605b0c39031ec485a

        SHA1

        b7d86ebe4e18cb6d2a48a1c97ac6f7e39c8a9b91

        SHA256

        e45afce6eff080d568e3e059498f5768585143336c600011273366905f4fc635

        SHA512

        b02bd950384cf3d656c4b8f590013392e3028c6183aa9321bd91b6fc1f5d41b03771313ca5e3305398a60642fa14fc5a98daf3e6decba586c80861bafcbf0c64

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\OemVista.inf
        Filesize

        7KB

        MD5

        26009f092ba352c1a64322268b47e0e3

        SHA1

        e1b2220cd8dcaef6f7411a527705bd90a5922099

        SHA256

        150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

        SHA512

        c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        Filesize

        99KB

        MD5

        1e3cf83b17891aee98c3e30012f0b034

        SHA1

        824f299e8efd95beca7dd531a1067bfd5f03b646

        SHA256

        9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f

        SHA512

        fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b

        Download Submit

      • C:\ProgramData\JyNor\L60z9~16\DuiLib.dll
        Filesize

        2.3MB

        MD5

        3fe2756032dd2b102b5aedc719b46d10

        SHA1

        1b8d2b21350f9bfe270b12d77a9f793f5eecead2

        SHA256

        03c2632bc7ae92e409c063e4f260b1a7199ff6cdd7ba0b0455fd1947afe79b99

        SHA512

        800c62ea9d22c3d044de0497775b4f9a72a360ee0e4c222e267453b7d9cf7f90754689988c684aabdcffa8f245e9e9a48a2616f22a5cccfb11e06ad70b3160ae

        Download Submit

      • C:\ProgramData\JyNor\L60z9~16\SK.txt
        Filesize

        204KB

        MD5

        108f9300c28d82bcd7cedc8769e91be6

        SHA1

        bbd6ab51e82887e8c8b0cf1a9e55a84078075100

        SHA256

        e7220fe3d5e1eb97584f88e0d25af27a018d748100b3f840c697b71c1037b238

        SHA512

        bb7f7d6a483cb01cf69895eba967d2a3b10d4af430c1d2ff0c16f5d3194a279fe525bf344d964d44c1c16ff9df79ffcee1d4ebf28f838909eccf948dc5d70703

        Download Submit

      • C:\ProgramData\JyNor\L60z9~16\WXWorkUpdate.exe
        Filesize

        1.2MB

        MD5

        919845c9609f79ce1927249ec6d541c2

        SHA1

        f7fb946e5895ec3aecdd25e5403ea10374744bc0

        SHA256

        9843402d481a895f2f43601e2bf7164eb5589f583f9b58978c61677eb17e0990

        SHA512

        c612f0507790fca918eab7e34817a51ae3bc935a15b200b659c1cc8aeaf9c97cfbc1203d921fe38eedc402c3b1d8f88998f8f39dbf25e845139738d50a945092

        Download Submit

      • C:\ProgramData\JyNor\L60z9~16\a
        Filesize

        1.2MB

        MD5

        2e9d70be56fa937fbc8d342997a3813b

        SHA1

        3adce5be09b0924ba7f4e02444c9f19027e0eca3

        SHA256

        7388e270cc163022c540650f08823825be0076a0b25b0e7bc4bdc6319e28cf79

        SHA512

        7c562d88c62f5a4cbf7ba0351e5793b6363439e626e922d81145334a3523eb371f68f9d0ee117e12f055e39d09267442233a735b2a8768bbf5de048c952567d8

        Download Submit

      • C:\ProgramData\JyNor\L60z9~16\msvcp140.dll
        Filesize

        429KB

        MD5

        cfbdf284c12056347e6773cb3949fbba

        SHA1

        ad3fa5fbbc4296d4a901ea94460762faf3d6a2b8

        SHA256

        bbecdfda2551b01aa16005c88305982c360a9fb9ba3d9be2fb15f2e9c6eb809f

        SHA512

        2f24eac94d51f8f28c8e6b6234ca2e481e0f8f1a73df62766ff4f5640480377fb2c4a469babedb87d303503994b469e570aaf725e16da6f9b2d6a77f15b4623f

        Download Submit

      • C:\ProgramData\JyNor\L60z9~16\s
        Filesize

        1.2MB

        MD5

        25e6c245c0b2d8f895be134bd54390d1

        SHA1

        41096adbc64cb7b310f7534dda521b5dec86d994

        SHA256

        0ce06d64d518f0df305711964a2adf8e24eb234ec1c8a2cab6f37c2a04d147bd

        SHA512

        36df8e9877b2cdab0a5dead00fc47cb0a1d3aee44f35424d0f8e776c3d38f9251b36ebee0444989089ba22eab52d2744f2863fcecce0e3469aee79040da3b55b

        Download Submit

      • C:\ProgramData\JyNor\L60z9~16\vcruntime140.dll
        Filesize

        81KB

        MD5

        8e65e033799eb9fd46bc5c184e7d1b85

        SHA1

        e1cc5313be1f7df4c43697f8f701305585fe4e71

        SHA256

        be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4

        SHA512

        e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd

        Download Submit

      • C:\ProgramData\letsvpn-latest.exe
        Filesize

        14.7MB

        MD5

        e039e221b48fc7c02517d127e158b89f

        SHA1

        79eed88061472ae590616556f31576ca13bfc7fb

        SHA256

        dc30e5dab15392627d30a506f6304030c581fc00716703fc31add10ff263d70b

        SHA512

        87231c025bb94771e89a639c9cb1528763f096059f8806227b8ab45a8f1ea5cd3d94fdc91cb20dd140b91a14904653517f7b6673a142a864a58a2726d14ae4b8

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        Filesize

        1KB

        MD5

        33b19d75aa77114216dbc23f43b195e3

        SHA1

        36a6c3975e619e0c5232aa4f5b7dc1fec9525535

        SHA256

        b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

        SHA512

        676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        11KB

        MD5

        664c3dcb477c3bdea4818450063559ec

        SHA1

        67cdd771d9a0d91513bc277053b01f075109dd2a

        SHA256

        39019c6cfcd3ca55b14b39ae0dfe8794e09d89aa3a6d44e4999e7dda61e7abf4

        SHA512

        cce02cfeeefef0212ac71a39a7c08d6e31f41b6176052de3e0681dcdeda310e5555ffd7edbbc92a9477f976fc6d968a5af41bfa96923568b7f8bc8047c3a8192

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pdhrhrjn.dk2.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsnB382.tmp\System.dll
        Filesize

        12KB

        MD5

        192639861e3dc2dc5c08bb8f8c7260d5

        SHA1

        58d30e460609e22fa0098bc27d928b689ef9af78

        SHA256

        23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

        SHA512

        6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsnB382.tmp\modern-wizard.bmp
        Filesize

        51KB

        MD5

        7f8e1969b0874c8fb9ab44fc36575380

        SHA1

        3057c9ce90a23d29f7d0854472f9f44e87b0f09a

        SHA256

        076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd

        SHA512

        7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsnB382.tmp\nsDialogs.dll
        Filesize

        9KB

        MD5

        b7d61f3f56abf7b7ff0d4e7da3ad783d

        SHA1

        15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

        SHA256

        89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

        SHA512

        6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsnB382.tmp\nsExec.dll
        Filesize

        7KB

        MD5

        11092c1d3fbb449a60695c44f9f3d183

        SHA1

        b89d614755f2e943df4d510d87a7fc1a3bcf5a33

        SHA256

        2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

        SHA512

        c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

        Download Submit

      • C:\Users\Admin\AppData\Roaming\79VtC.bat
        Filesize

        392B

        MD5

        30d6eb22d6aeec10347239b17b023bf4

        SHA1

        e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

        SHA256

        659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

        SHA512

        500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

        Download Submit

      • \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
        Filesize

        38KB

        MD5

        c10ccdec5d7af458e726a51bb3cdc732

        SHA1

        0553aab8c2106abb4120353360d747b0a2b4c94f

        SHA256

        589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

        SHA512

        7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

        Download Submit

      • \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
        Filesize

        10KB

        MD5

        f73ac62e8df97faf3fc8d83e7f71bf3f

        SHA1

        619a6e8f7a9803a4c71f73060649903606beaf4e

        SHA256

        cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

        SHA512

        f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

        Download Submit

      • memory/464-4-0x0000000180000000-0x0000000180264000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/464-3-0x0000000180000000-0x0000000180264000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/464-19-0x0000000180000000-0x0000000180264000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/464-1-0x0000000180000000-0x0000000180264000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/2696-542-0x000000006F030000-0x000000006F07C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/2696-553-0x0000000006F10000-0x0000000006FB3000-memory.dmp

        Filesize

        652KB

        Download

      • memory/2696-539-0x0000000006330000-0x000000000637C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/2696-530-0x0000000005630000-0x0000000005984000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/2696-541-0x0000000006220000-0x0000000006252000-memory.dmp

        Filesize

        200KB

        Download

      • memory/2696-562-0x0000000007230000-0x0000000007238000-memory.dmp

        Filesize

        32KB

        Download

      • memory/2696-552-0x00000000061E0000-0x00000000061FE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/2696-561-0x00000000072F0000-0x000000000730A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/2696-554-0x0000000007640000-0x0000000007CBA000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/2696-555-0x0000000006FE0000-0x0000000006FFA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/2696-556-0x0000000007020000-0x000000000702A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2696-557-0x0000000007250000-0x00000000072E6000-memory.dmp

        Filesize

        600KB

        Download

      • memory/2696-558-0x00000000071B0000-0x00000000071C1000-memory.dmp

        Filesize

        68KB

        Download

      • memory/2696-559-0x00000000071E0000-0x00000000071EE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2696-560-0x00000000071F0000-0x0000000007204000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4072-82-0x0000000002E50000-0x0000000002EB9000-memory.dmp

        Filesize

        420KB

        Download

      • memory/4072-84-0x0000000002E50000-0x0000000002EB9000-memory.dmp

        Filesize

        420KB

        Download

      • memory/4072-83-0x0000000002E50000-0x0000000002EB9000-memory.dmp

        Filesize

        420KB

        Download

      • memory/4072-81-0x0000000002E50000-0x0000000002EB9000-memory.dmp

        Filesize

        420KB

        Download

      • memory/4072-31-0x0000000002E50000-0x0000000002EB9000-memory.dmp

        Filesize

        420KB

        Download

      • memory/4072-50-0x0000000002E50000-0x0000000002EB9000-memory.dmp

        Filesize

        420KB

        Download

      • memory/4072-30-0x0000000002E50000-0x0000000002EB9000-memory.dmp

        Filesize

        420KB

        Download

      • memory/4072-29-0x0000000002E50000-0x0000000002EB9000-memory.dmp

        Filesize

        420KB

        Download

      • memory/4416-67-0x0000000006650000-0x000000000669C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4416-54-0x0000000005F30000-0x0000000005F96000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4416-55-0x0000000005FA0000-0x0000000006006000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4416-53-0x0000000005760000-0x0000000005782000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4416-52-0x00000000057D0000-0x0000000005DF8000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/4416-65-0x0000000006110000-0x0000000006464000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/4416-51-0x0000000003040000-0x0000000003076000-memory.dmp

        Filesize

        216KB

        Download

      • memory/4416-66-0x0000000006620000-0x000000000663E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4976-724-0x000000002F9A0000-0x000000002F9B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4976-749-0x0000000032520000-0x0000000032532000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4976-698-0x0000000005170000-0x00000000051B6000-memory.dmp

        Filesize

        280KB

        Download

      • memory/4976-708-0x0000000005530000-0x0000000005884000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/4976-714-0x0000000005F20000-0x0000000005F3E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4976-715-0x0000000005F40000-0x0000000005F5A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4976-719-0x0000000005F70000-0x0000000005F78000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4976-720-0x0000000005F90000-0x0000000005F9A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4976-718-0x0000000005FC0000-0x0000000005FE6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/4976-717-0x0000000005F80000-0x0000000005F8A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4976-702-0x0000000005140000-0x000000000514A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4976-694-0x0000000004D50000-0x0000000004D74000-memory.dmp

        Filesize

        144KB

        Download

      • memory/4976-710-0x0000000005EF0000-0x0000000005F12000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4976-709-0x0000000006010000-0x000000000653C000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/4976-721-0x0000000005FA0000-0x0000000005FAA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4976-722-0x000000002F5C0000-0x000000002F5CA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4976-723-0x000000002F9C0000-0x000000002F9E6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/4976-690-0x00000000003F0000-0x0000000000574000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/4976-725-0x0000000030690000-0x0000000030722000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4976-730-0x000000002FFD0000-0x000000002FFD8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4976-731-0x0000000031FB0000-0x0000000031FE8000-memory.dmp

        Filesize

        224KB

        Download

      • memory/4976-732-0x0000000030680000-0x000000003068E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4976-745-0x0000000033AF0000-0x0000000034094000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4976-750-0x0000000032540000-0x0000000032554000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4976-751-0x0000000032560000-0x0000000032568000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4976-707-0x0000000005440000-0x00000000054F2000-memory.dmp

        Filesize

        712KB

        Download

      • memory/4976-748-0x0000000031F80000-0x0000000031F88000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4976-752-0x00000000336C0000-0x00000000336D2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4976-753-0x0000000033A80000-0x0000000033A9E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4976-756-0x000000006C720000-0x000000006D188000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4976-757-0x0000000034C40000-0x0000000034DC6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/4976-764-0x0000000033780000-0x0000000033790000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4976-765-0x0000000034720000-0x0000000034736000-memory.dmp

        Filesize

        88KB

        Download

      • memory/4976-766-0x00000000337A0000-0x00000000337B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4976-782-0x0000000034F90000-0x0000000034FDA000-memory.dmp

        Filesize

        296KB

        Download

      • memory/4976-783-0x0000000035AA0000-0x0000000035AEC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4976-784-0x0000000035E20000-0x0000000035E96000-memory.dmp

        Filesize

        472KB

        Download

      • memory/4976-794-0x0000000035F70000-0x0000000036013000-memory.dmp

        Filesize

        652KB

        Download

      • memory/4976-795-0x0000000036080000-0x0000000036091000-memory.dmp

        Filesize

        68KB

        Download

      • memory/4976-796-0x0000000036770000-0x00000000367A2000-memory.dmp

        Filesize

        200KB

        Download

      • memory/4976-797-0x000000006C720000-0x000000006D188000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4976-799-0x000000006C720000-0x000000006D188000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4976-800-0x000000006C720000-0x000000006D188000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4976-801-0x000000006C720000-0x000000006D188000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4976-805-0x000000006C720000-0x000000006D188000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4976-808-0x000000006C720000-0x000000006D188000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4976-809-0x000000006C720000-0x000000006D188000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4976-810-0x000000006C720000-0x000000006D188000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4976-811-0x000000006C720000-0x000000006D188000-memory.dmp

        Filesize

        10.4MB

        Download