Overview

overview

10

Static

static

3

72647cc37c...a0.exe

windows7-x64

10

72647cc37c...a0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-12-2024 02:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72647cc37c58f07c6e3a2ce90fcc04ae73f76ff02d9e6a0238ac7fe2222ddda0.exe

  • Size

    15.4MB

  • MD5

    af2833e834f0075925efd5def71dfedc

  • SHA1

    2b96c972ef54296998a4c032b093f33527e2bf2f

  • SHA256

    72647cc37c58f07c6e3a2ce90fcc04ae73f76ff02d9e6a0238ac7fe2222ddda0

  • SHA512

    6f00a417331200aff6d6633063a1713e6ea83b9f202bde9693c456cac56242937d27282dbe7fcf3b8b117b7241406d672796baac5abe85f2a6dab0d5df6e9a9a

  • SSDEEP

    196608:CVcPiSoR+91pUGjq941X4bZWF321bkADocBk1QujqrKUy5PT7V/jp6siiqc0jV7H:Su1f1XLg1EGkHe0TBN6sivhJyS7Z9

Score
10/10
gh0stratpurplefoxdiscoveryevasionexecutionpersistenceprivilege_escalationratrootkittrojan

Malware Config

Signatures

  • Detect PurpleFox Rootkit 2 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Purplefox family
    purplefox
  • Drops file in Drivers directory 4 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 12 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72647cc37c58f07c6e3a2ce90fcc04ae73f76ff02d9e6a0238ac7fe2222ddda0.exe
    "C:\Users\Admin\AppData\Local\Temp\72647cc37c58f07c6e3a2ce90fcc04ae73f76ff02d9e6a0238ac7fe2222ddda0.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3520
    • C:\Windows\letsvpn-latest.exe
      "C:\Windows\letsvpn-latest.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3492
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1632
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1912
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        PID:2876
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3808
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:5060
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3448
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4040
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2440
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2924
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4356
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3936
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsVPN
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:916
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        PID:264
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2696
        • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Modifies registry class
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4140
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C ipconfig /all
            5⤵
            • System Location Discovery: System Language Discovery
            PID:916
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:228
          • C:\Windows\SysWOW64\netsh.exe
            C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4060
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C route print
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2104
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4920
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            PID:5028
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3468
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4848
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\sainbox.exe
        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\sainbox.exe"
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Executes dropped EXE
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:1552
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Windows\svchost.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:3128
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3440
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fa2615ec-93ad-2a41-ace7-c3be17237549}\oemvista.inf" "9" "4d14a44ff" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4180
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "000000000000014C"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:212
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:2440
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
    1⤵
      PID:2180
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:4108

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      2
      T1059

      PowerShell

      1
      T1059.001

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Defense Evasion

      Impair Defenses

      1
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Modify Registry

      3
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Credential Access

      Discovery

      Network Service Discovery

      1
      T1046

      Peripheral Device Discovery

      2
      T1120

      Query Registry

      5
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      6
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
        Filesize

        318B

        MD5

        b34636a4e04de02d079ba7325e7565f0

        SHA1

        f32c1211eac22409bb195415cb5a8063431f75cd

        SHA256

        a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

        SHA512

        6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

        Download Submit

      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        Filesize

        240KB

        MD5

        bd8643e5db648810348aa0755e455b70

        SHA1

        119cb1fb3057d9759d0abb3dfdafc460456c1cc4

        SHA256

        bec6a116ea2224dd1532c6eaf20e4d61199240e55ccd0270199fbd22f2806477

        SHA512

        b8033d8989c66431e1771ffc6d2549a4d1e32b8612b7331e7a2931ddad3e31c8a7e1af8ef129883034b1fcf466b8ad0e1cab431cbf5c20c724f4eef53468f714

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\CommunityToolkit.Mvvm.dll
        Filesize

        109KB

        MD5

        143351606a574d84328219a7c18c7219

        SHA1

        8e47c7b530f40553f4a88daff11d78255cc77730

        SHA256

        cbe3b5714c52ad9ff8885d9893c9ed77ad54485a7c5bae3a75151c06d3ae7c4f

        SHA512

        b4698855a37639cac6dd4c400d11028bba1433f43e811e23881a72f7875048c77cf0dbd8bab8c0374ae7182fe41f37f69f5942d770fbbead86b12805b6647291

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
        Filesize

        1.5MB

        MD5

        ca72f8ead2ae568acc481f685385fb60

        SHA1

        887a1d53c8b61c81a80592ff62cf9cdf56b29d18

        SHA256

        d287af28a137d9c015531eae28815d2b0d0a53879318f104ef34e5d86e2c4618

        SHA512

        8da648e1363d490d6a4ee5ec9e38aec86384f345ae5fd58150b2affce8c3c208e1a55598cfe820d00e9448910598ffde29d2824275ebaafaa7d33279898a2e4c

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe.config
        Filesize

        26KB

        MD5

        6126a1ab971d6bd4761f45791af90b1e

        SHA1

        36013821807f6fe08fe3b60a22ec519fd3e5579c

        SHA256

        9b7b7ec30f305b3cd9da40662f95ed57ae89ed8afd2b11d26503e387ff3c262d

        SHA512

        9f74f9f4ad593980337099717ba1e6b584530ee0e192b137297961d1550a70ae3a30fc1bf3e6e670fb817682354648d610f2a542b753a61f397ccaca20908510

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsVPNDomainModel.dll
        Filesize

        20KB

        MD5

        85bee1626071af1b07e79fc7963731e4

        SHA1

        d804e63940798891928f3ba29be85cf06fbb9769

        SHA256

        222f84cd3111f90b7ce045119e63678ee180ab0a7c4f48cae25f097ee425debe

        SHA512

        6649931736a607dceea5ec8180e07c14c331761a7dd0fa5ab4187d3302c0a51262ccce40024d6540f3453d8bdd43785c5f8d45e9c5252e097b69b30fced78832

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\Newtonsoft.Json.dll
        Filesize

        693KB

        MD5

        33a3c1df70cfab1888a4b20565515f81

        SHA1

        c1bfab7454dda45074a6e2b9ae4e9a2712830af6

        SHA256

        0c3c293507c487b76021baaded76defb0fecaf01c1327a448a9b756987595a9e

        SHA512

        76d3e0c34c5e793283910f93af3693355abdd374cf50234496cf3bbebf82a381113fbb4d53ad469f2f5a001b2cb96c761310a3825f8973ae61a4e8b59061cb28

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\System.Memory.dll
        Filesize

        138KB

        MD5

        2b370cc14974e2c9955a2a3bdb5cb78a

        SHA1

        98878fb3998e492cf964a2e2af2ca187372ce5b5

        SHA256

        334ed3950898aa1f1a62a15bc411972246ab59498ecc9418f75695a2c1a5ba71

        SHA512

        f5c06d3f184baa1d7a6c9ebff9c5f5bbe87f61318710b0b19a81ce2fa26d3fabfd2af504d558c8b35a81e4c0846325260a2a425f2f68fde2b075addecadacb3d

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\System.Runtime.CompilerServices.Unsafe.dll
        Filesize

        18KB

        MD5

        e0c5b0735a94152bc191a01b57c89db4

        SHA1

        15f546b9ea478fa2cee8c06e8d178a452056a7bc

        SHA256

        6ba160798e7d5ed98328c938c40ce1b8db1b3e603926e7c5220f5b22b243f8e1

        SHA512

        8b39993adea19d6697b929cebd529f1ae812379973e1e71c5459a5bc05608d071a377d4d88320c67b2424dfc681c97a01e6b361b6101d4720a49acd8e403c2c3

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\System.Runtime.InteropServices.RuntimeInformation.dll
        Filesize

        21KB

        MD5

        2a27f887342305cecd5ba36c8dbd4267

        SHA1

        2ca43487e37a67824b071d2870765f26c33ef7f2

        SHA256

        26a04bc90979886d477bb9777545e75a65c5f67443fdb5185c2fea249afc882b

        SHA512

        8d25ed902e2ca4191118b75cae0ea6338d0ce6aac3d10c08288e802704a115b15988a764899f3368aca0e7798933c5d4925721d82d7a7228372f435a36e1eafe

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\Utils.dll
        Filesize

        126KB

        MD5

        8af72dc9783c52125e229f8b79afba94

        SHA1

        71178bc7cfced6bc5dcb45ed666cdbe2c55182dd

        SHA256

        68ae722154cebfb3a3ca59b135e182a68fa0d6966a089008028f97022849bbc5

        SHA512

        dcada700522b78fe0006e84c6599a9857269512eb65a68c0475635f76d5805c43decad74232eb39dae83f987b3dabafe07129d44cce950c8dc9efd11901599e2

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\log4net.config
        Filesize

        1KB

        MD5

        7a7521bc7f838610905ce0286324ce39

        SHA1

        8ab90dd0c4b6edb79a6af2233340d0f59e9ac195

        SHA256

        2a322178557c88cc3c608101e8fc84bfd2f8fa9b81483a443bb3d09779de218d

        SHA512

        b25dfdce0977eaf7159df5eabe4b147a6c0adac39c84d1c7a9fe748446a10c8d2e20d04cf36221057aa210633df65f2a460821c8c79a2db16c912ec53a714d83

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.11.2\log4net.dll
        Filesize

        273KB

        MD5

        5b9a663d7584d8e605b0c39031ec485a

        SHA1

        b7d86ebe4e18cb6d2a48a1c97ac6f7e39c8a9b91

        SHA256

        e45afce6eff080d568e3e059498f5768585143336c600011273366905f4fc635

        SHA512

        b02bd950384cf3d656c4b8f590013392e3028c6183aa9321bd91b6fc1f5d41b03771313ca5e3305398a60642fa14fc5a98daf3e6decba586c80861bafcbf0c64

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\OemVista.inf
        Filesize

        7KB

        MD5

        26009f092ba352c1a64322268b47e0e3

        SHA1

        e1b2220cd8dcaef6f7411a527705bd90a5922099

        SHA256

        150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

        SHA512

        c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        Filesize

        99KB

        MD5

        1e3cf83b17891aee98c3e30012f0b034

        SHA1

        824f299e8efd95beca7dd531a1067bfd5f03b646

        SHA256

        9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f

        SHA512

        fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        Filesize

        1KB

        MD5

        33b19d75aa77114216dbc23f43b195e3

        SHA1

        36a6c3975e619e0c5232aa4f5b7dc1fec9525535

        SHA256

        b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

        SHA512

        676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        11KB

        MD5

        84cb8283472a23ba1559c4cb89d01906

        SHA1

        872fb96ec29a3411993d5a5c41233020d9d5857f

        SHA256

        e1cc459902a72570d3cdfbe735e5ae6a96d9c944e6c9a32dec46ab3e28549bdc

        SHA512

        547a62a685ea1dcc4380b53b364b43ee1f84df6b9838d209ec05bc5222e097c72f20d2a6b158495839dc4cccf1a749a44ad0097d191210c310924feb51f0eee0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_54fqleog.0yd.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsuB799.tmp\System.dll
        Filesize

        12KB

        MD5

        192639861e3dc2dc5c08bb8f8c7260d5

        SHA1

        58d30e460609e22fa0098bc27d928b689ef9af78

        SHA256

        23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

        SHA512

        6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsuB799.tmp\modern-wizard.bmp
        Filesize

        51KB

        MD5

        7f8e1969b0874c8fb9ab44fc36575380

        SHA1

        3057c9ce90a23d29f7d0854472f9f44e87b0f09a

        SHA256

        076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd

        SHA512

        7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsuB799.tmp\nsDialogs.dll
        Filesize

        9KB

        MD5

        b7d61f3f56abf7b7ff0d4e7da3ad783d

        SHA1

        15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

        SHA256

        89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

        SHA512

        6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nsuB799.tmp\nsExec.dll
        Filesize

        7KB

        MD5

        11092c1d3fbb449a60695c44f9f3d183

        SHA1

        b89d614755f2e943df4d510d87a7fc1a3bcf5a33

        SHA256

        2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

        SHA512

        c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

        Download Submit

      • C:\Windows\letsvpn-latest.exe
        Filesize

        14.7MB

        MD5

        e039e221b48fc7c02517d127e158b89f

        SHA1

        79eed88061472ae590616556f31576ca13bfc7fb

        SHA256

        dc30e5dab15392627d30a506f6304030c581fc00716703fc31add10ff263d70b

        SHA512

        87231c025bb94771e89a639c9cb1528763f096059f8806227b8ab45a8f1ea5cd3d94fdc91cb20dd140b91a14904653517f7b6673a142a864a58a2726d14ae4b8

        Download Submit

      • C:\Windows\svchost.exe
        Filesize

        1.7MB

        MD5

        4ab645302c818acbb6ecfa1b677b2c0b

        SHA1

        3a2c2cecd29da6745b1757151e1aae92253c674c

        SHA256

        4800add84a0ace4482dbe4ac41e69dc49f87ddaba3d7571235f9d0784c01b7ae

        SHA512

        b8c6a82471cd7bd785278a41f0e48b8d716f70ef653ab3dd84a2ea71a5d6e997540143a80d479e72ae07a6a29bd4566930a9c0a5bb2e53cfb4d7ac4bcfc9616b

        Download Submit

      • \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
        Filesize

        38KB

        MD5

        c10ccdec5d7af458e726a51bb3cdc732

        SHA1

        0553aab8c2106abb4120353360d747b0a2b4c94f

        SHA256

        589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

        SHA512

        7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

        Download Submit

      • \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
        Filesize

        10KB

        MD5

        f73ac62e8df97faf3fc8d83e7f71bf3f

        SHA1

        619a6e8f7a9803a4c71f73060649903606beaf4e

        SHA256

        cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

        SHA512

        f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

        Download Submit

      • memory/1552-50-0x0000000010000000-0x000000001019E000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/1632-78-0x0000000005760000-0x0000000005AB4000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/1632-80-0x0000000005CB0000-0x0000000005CFC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/1632-49-0x0000000004690000-0x00000000046C6000-memory.dmp

        Filesize

        216KB

        Download

      • memory/1632-54-0x0000000004D40000-0x0000000005368000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/1632-65-0x00000000054E0000-0x0000000005502000-memory.dmp

        Filesize

        136KB

        Download

      • memory/1632-66-0x0000000005580000-0x00000000055E6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/1632-67-0x00000000055F0000-0x0000000005656000-memory.dmp

        Filesize

        408KB

        Download

      • memory/1632-79-0x0000000005C60000-0x0000000005C7E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/1912-569-0x0000000007DE0000-0x0000000007DE8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1912-544-0x00000000061B0000-0x0000000006504000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/1912-560-0x0000000007A00000-0x0000000007AA3000-memory.dmp

        Filesize

        652KB

        Download

      • memory/1912-559-0x0000000006DD0000-0x0000000006DEE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/1912-549-0x000000006F770000-0x000000006F7BC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/1912-548-0x0000000006D90000-0x0000000006DC2000-memory.dmp

        Filesize

        200KB

        Download

      • memory/1912-546-0x0000000006910000-0x000000000695C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/1912-561-0x00000000081B0000-0x000000000882A000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/1912-562-0x0000000007B80000-0x0000000007B9A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1912-563-0x0000000007BD0000-0x0000000007BDA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/1912-564-0x0000000007E00000-0x0000000007E96000-memory.dmp

        Filesize

        600KB

        Download

      • memory/1912-568-0x0000000007EA0000-0x0000000007EBA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1912-567-0x0000000007DA0000-0x0000000007DB4000-memory.dmp

        Filesize

        80KB

        Download

      • memory/1912-566-0x0000000007D90000-0x0000000007D9E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/1912-565-0x0000000007D60000-0x0000000007D71000-memory.dmp

        Filesize

        68KB

        Download

      • memory/4140-716-0x0000000006470000-0x000000000699C000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/4140-767-0x0000000033B30000-0x0000000033B42000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4140-714-0x00000000058D0000-0x0000000005982000-memory.dmp

        Filesize

        712KB

        Download

      • memory/4140-717-0x0000000006200000-0x0000000006222000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4140-721-0x0000000006390000-0x00000000063AE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4140-722-0x00000000063B0000-0x00000000063CA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4140-709-0x0000000005250000-0x000000000525A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4140-705-0x0000000005600000-0x0000000005646000-memory.dmp

        Filesize

        280KB

        Download

      • memory/4140-734-0x00000000063D0000-0x00000000063D8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4140-701-0x0000000002B50000-0x0000000002B74000-memory.dmp

        Filesize

        144KB

        Download

      • memory/4140-730-0x0000000006420000-0x0000000006446000-memory.dmp

        Filesize

        152KB

        Download

      • memory/4140-726-0x00000000063E0000-0x00000000063EA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4140-697-0x0000000000710000-0x0000000000894000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/4140-735-0x00000000063F0000-0x00000000063FA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4140-736-0x0000000006400000-0x000000000640A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4140-737-0x000000002F990000-0x000000002F99A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4140-738-0x000000002FE20000-0x000000002FE46000-memory.dmp

        Filesize

        152KB

        Download

      • memory/4140-739-0x000000002F9A0000-0x000000002F9B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4140-742-0x0000000030C20000-0x0000000030CB2000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4140-748-0x0000000030530000-0x0000000030538000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4140-752-0x0000000032320000-0x0000000032358000-memory.dmp

        Filesize

        224KB

        Download

      • memory/4140-753-0x00000000322E0000-0x00000000322EE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4140-760-0x0000000033F40000-0x00000000344E4000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4140-764-0x0000000033870000-0x0000000033882000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4140-765-0x0000000033890000-0x00000000338A4000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4140-763-0x0000000033040000-0x0000000033048000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4140-766-0x00000000338B0000-0x00000000338B8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4140-715-0x0000000005990000-0x0000000005CE4000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/4140-768-0x0000000033EA0000-0x0000000033EBE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4140-771-0x0000000034940000-0x0000000034950000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4140-772-0x0000000030D20000-0x0000000030D5A000-memory.dmp

        Filesize

        232KB

        Download

      • memory/4140-773-0x0000000030CF0000-0x0000000030CF8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4140-774-0x0000000030D00000-0x0000000030D10000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4140-775-0x0000000030D80000-0x0000000030D9E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4140-776-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4140-777-0x00000000352A0000-0x0000000035426000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/4140-778-0x0000000030F70000-0x0000000030F80000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4140-781-0x0000000033BE0000-0x0000000033BF6000-memory.dmp

        Filesize

        88KB

        Download

      • memory/4140-782-0x0000000033030000-0x0000000033040000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4140-798-0x0000000035430000-0x000000003547A000-memory.dmp

        Filesize

        296KB

        Download

      • memory/4140-805-0x0000000035960000-0x00000000359AC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4140-810-0x0000000036470000-0x00000000364E6000-memory.dmp

        Filesize

        472KB

        Download

      • memory/4140-820-0x00000000365F0000-0x0000000036693000-memory.dmp

        Filesize

        652KB

        Download

      • memory/4140-821-0x00000000366F0000-0x0000000036701000-memory.dmp

        Filesize

        68KB

        Download

      • memory/4140-822-0x00000000375D0000-0x0000000037602000-memory.dmp

        Filesize

        200KB

        Download

      • memory/4140-827-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4140-829-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4140-830-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4140-831-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4140-833-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4140-834-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4140-835-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4140-836-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4140-837-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4140-838-0x000000006C990000-0x000000006D3F8000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4848-24-0x0000000010000000-0x000000001019E000-memory.dmp

        Filesize

        1.6MB

        Download