Overview

overview

10

Static

static

3

f59fbde32a...2b.exe

windows7-x64

10

f59fbde32a...2b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2025 00:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f59fbde32ab1337b3b287588619925fccc1ad42c5acd276ff2cb662e5bf25a2b.exe

  • Size

    15.7MB

  • MD5

    260acc17a495041dc2c98c82a2b896b5

  • SHA1

    4d119bff35beaa47ca506b2795824893fd0053c8

  • SHA256

    f59fbde32ab1337b3b287588619925fccc1ad42c5acd276ff2cb662e5bf25a2b

  • SHA512

    9ec8243c9e85bdefdc15ea3386286aa49facd7068c0d52167a6bb23614057e173885dc49f473171bbc4fe4621d3310d5bc302a23200b753a1a63bf45d296f88f

  • SSDEEP

    393216:C9lCKlon+UNPc5bSXy3v0zs8yj6BHuKrrT4wV9SrmP1i6FJ:C2+UNk5bhfG5HuKrrT4wVVP1i67

Score
10/10
gh0stratpurplefoxdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratrootkittrojan

Malware Config

Signatures

  • Detect PurpleFox Rootkit 1 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Purplefox family
    purplefox
  • Drops file in Drivers directory 4 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    defense_evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    defense_evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f59fbde32ab1337b3b287588619925fccc1ad42c5acd276ff2cb662e5bf25a2b.exe
    "C:\Users\Admin\AppData\Local\Temp\f59fbde32ab1337b3b287588619925fccc1ad42c5acd276ff2cb662e5bf25a2b.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Program Files (x86)\letsvpn-latest.exe
      "C:\Program Files (x86)\letsvpn-latest.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3732
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        PID:3264
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4904
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        PID:4800
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:412
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4448
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4384
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3376
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2844
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:5088
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4240
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsVPN
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2752
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe" checkNetFramework
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3472
        • C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe" checkNetFramework
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4284
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2060
        • C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Modifies registry class
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4952
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C ipconfig /all
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5000
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:860
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C route print
            5⤵
            • System Location Discovery: System Language Discovery
            PID:208
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1408
          • C:\Windows\SysWOW64\netsh.exe
            C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:632
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            PID:860
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4288
    • C:\Program Files (x86)\csrss.exe
      "C:\Program Files (x86)\csrss.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4908
      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Phxph.exe
        "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Phxph.exe"
        3⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Executes dropped EXE
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:2224
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\PROGRA~2\csrss.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3820
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4532
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0d82bd84-d425-7b42-8116-a11f59cb1fc5}\oemvista.inf" "9" "4d14a44ff" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:5000
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000100"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2504
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:4516
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:4044
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
      1⤵
        PID:828

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      2
      T1059

      PowerShell

      1
      T1059.001

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      2
      T1547.001

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Defense Evasion

      Impair Defenses

      1
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Modify Registry

      3
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Credential Access

      Discovery

      Network Service Discovery

      1
      T1046

      Peripheral Device Discovery

      2
      T1120

      Query Registry

      5
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      6
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\csrss.exe
        Filesize

        1.9MB

        MD5

        05258c560c2cba1b8b59b3db4e612da6

        SHA1

        34f9bff2a5b66e311017f00e09c954cfbbd66f8a

        SHA256

        29be5508137a704cc968c3a0ad4afcc938a1dd4b1e6838ce091b76e4da7ee3ce

        SHA512

        759f59b381641fa8ca95a35dea8bfe85872cfe576892bc03ebc6c50dda43db734876f320dd6d85a6d57fa23c060920c655d09488712be9e7376433d634600259

        Download Submit

      • C:\Program Files (x86)\letsvpn-latest.exe
        Filesize

        14.8MB

        MD5

        9f5f358aa1a85d222ad967f4538bc753

        SHA1

        567404faec3641f4df889c2c92164cee92723741

        SHA256

        eb11627e59757105bddb884540854d56b173fe42417878de4e7d246cac92c932

        SHA512

        d5a4c4b343704b96c98183d13d90e37065c8be0d0ed053696fb28b5e29f1432175d5e9f63c2d2879c3eb3541e4822a64ae7bfa2230c0c00b5c3ada0a1ac82bed

        Download Submit

      • C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
        Filesize

        318B

        MD5

        b34636a4e04de02d079ba7325e7565f0

        SHA1

        f32c1211eac22409bb195415cb5a8063431f75cd

        SHA256

        a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

        SHA512

        6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

        Download Submit

      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        Filesize

        242KB

        MD5

        3530cb1b45ff13ba4456e4ffbcae6379

        SHA1

        5be7b8e19418212a5a93e900c12830facfd6ba54

        SHA256

        e0669b6312baaef6a3c86f3142b333eab48494511405398bb09cc464881a43c9

        SHA512

        23baae23815fc946203be6d93cef84ff23fde8ed88017179c65b7de1f3b6114bc8343c277b8ae5a1d85aa59f25b5f146c1d827b7e4617bfd0aa0ff20359f49b5

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.12.0\.check_result
        Filesize

        33B

        MD5

        862d9ed729f9bd1209a13c49c8388cfc

        SHA1

        18c5c6faaec66d790893dd34d6a415879e36e92c

        SHA256

        a21ed21b8c02ad37840fb4374873858f650a7ebe9c29789d2562b51f30c2922b

        SHA512

        33c78de82c4b449b59beba7bc7f700f5a9e271007b7d79a95c99f994cc15c151fd25471dd8682beb06c55d4bb282e7890282947c8cd16419311e911900005fe5

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.12.0\CommunityToolkit.Mvvm.dll
        Filesize

        111KB

        MD5

        c5485166b86b4cd6de97c4dc8d0fbefb

        SHA1

        c047f339399098e7e4bf92ef7a8f38c1e5d5054d

        SHA256

        21678620bf5e7b4c8481270594b0a36615be6152ca7a9396487364712236a3d5

        SHA512

        33efda5903587d17a698bfaec6e5c119d4adcfc23ea1588f2b155ffcba88761e40e1db791f545a064effdc63e6ba7aa68027c96b4a632331c0ea7297ac093f26

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe
        Filesize

        1.5MB

        MD5

        56162a01d3de7cb90eb9a2222c6b8f24

        SHA1

        c4c10199b5f7d50d641d115f9d049832ec836785

        SHA256

        a41077ed210d8d454d627d15663b7523c33e6f7386cd920a56fbcfbb0a37547d

        SHA512

        23c4aac046ffdecaa64acbee9579634c419202be43463927dfabf9798ded17b1b7a1199f1db54e247d28d82f39f3f352ac3acbade2118c67717fd37260bd8b4f

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.12.0\LetsPRO.exe.config
        Filesize

        26KB

        MD5

        11752aa56f176fbbbf36420ec8db613a

        SHA1

        0affc2837cee71750450911d11968e0692947f13

        SHA256

        d66328eb01118a727e919b52318562094f2ff593bd33e5d3aab5e73602388dfa

        SHA512

        ed78045e4b6b85a1a0557c2ccd85a27e90defc48e50d2833d3d8d23526dc8d1040a64e883cb42aea3052d499ea4c95e775384ae710b1222191ead6f8b0e0b560

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.12.0\LetsVPNDomainModel.dll
        Filesize

        22KB

        MD5

        4fb031cb8840ee01cb6aa90696557143

        SHA1

        b009c8c975929b73dd977969e6816066d57f39c6

        SHA256

        64b09932ef5b25f5c2c185fe955c7784ab23cdf7d12fdad77fe05947e20006ba

        SHA512

        03731c0f6423f2fa3d6710b86c7cc41aa970058b818ab724321040984841dc451109638c813d564cb89dd00af3962e84811aed5a3b37ae9a1b9c1febeb85ae60

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.12.0\Newtonsoft.Json.dll
        Filesize

        695KB

        MD5

        3b3f8e087fc13a4b7bc9cf7dbba4ed9b

        SHA1

        321e0d0c5c275f2f57af78bc465535a923d2427c

        SHA256

        ae71f96b5316a5b8eff90f2da4c9b55c57fb6a74193f380deb38e49fe1010dde

        SHA512

        f823d1460eb52fd039c248e6353587adb2b78ca9ef988aa9ec7402c428fc3f178d099d5ecd106fdd9e2e051d87db4a799cd3de51c402e5c79e5014e6c8c6a6b5

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.12.0\Utils.dll
        Filesize

        127KB

        MD5

        0e444739d07678a3f6ea4202c4237832

        SHA1

        0689c9cdad379b4b0952674a7bf75a5a1f2f33a9

        SHA256

        a3aab8ca7b0747242207d1223e241e602b45ba69f25ba5b611a12eeacd19ec1a

        SHA512

        85f6d4920d93f8ee2bb7a384424c9eea25cc5591bf7a7301bdc31170944549b3860a90c5694f194ee0f9cd85f0ea053e89039f95ff806b735e526d583ee7e0bf

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.12.0\log4net.config
        Filesize

        1KB

        MD5

        7a7521bc7f838610905ce0286324ce39

        SHA1

        8ab90dd0c4b6edb79a6af2233340d0f59e9ac195

        SHA256

        2a322178557c88cc3c608101e8fc84bfd2f8fa9b81483a443bb3d09779de218d

        SHA512

        b25dfdce0977eaf7159df5eabe4b147a6c0adac39c84d1c7a9fe748446a10c8d2e20d04cf36221057aa210633df65f2a460821c8c79a2db16c912ec53a714d83

        Download Submit

      • C:\Program Files (x86)\letsvpn\app-3.12.0\log4net.dll
        Filesize

        275KB

        MD5

        c5098ff401b766e6e554499d37d0b716

        SHA1

        fd4c3df050ec2b30740e2d62b27a9e375401f190

        SHA256

        b015c62c09b4033d0a4caae36f3a9804a8cee2549145e199ada5a9bf51095e0d

        SHA512

        04f3261ed8d59e5e8455d868cb7ceef97466fb4fc57a98544024f53c4ba9d935e9441169f0705877cf3578f2ef4fc1b54921e9e15ecc70003c67452ae1393f01

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\OemVista.inf
        Filesize

        7KB

        MD5

        26009f092ba352c1a64322268b47e0e3

        SHA1

        e1b2220cd8dcaef6f7411a527705bd90a5922099

        SHA256

        150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

        SHA512

        c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

        Download Submit

      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        Filesize

        99KB

        MD5

        1e3cf83b17891aee98c3e30012f0b034

        SHA1

        824f299e8efd95beca7dd531a1067bfd5f03b646

        SHA256

        9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f

        SHA512

        fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LetsPRO.exe.log
        Filesize

        2KB

        MD5

        72144e1e4d46d0ccfb961c95394d4ffe

        SHA1

        05507f12fdc30a390d76e4cd266f411ee5916f14

        SHA256

        8471254ad241b8bbf04593d0f07bbd3bcef00a4c0393392851ae25e5e40d216d

        SHA512

        d12ed1381607db2694b808c9228998c37929f3b2201ae418a132999ce22e34b323ba705cedd8d28ba1b81134180981d03349307d3945e1e6b3fee91af82920a1

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o0srlhdj.234.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nszCFE4.tmp\System.dll
        Filesize

        12KB

        MD5

        192639861e3dc2dc5c08bb8f8c7260d5

        SHA1

        58d30e460609e22fa0098bc27d928b689ef9af78

        SHA256

        23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

        SHA512

        6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nszCFE4.tmp\modern-wizard.bmp
        Filesize

        51KB

        MD5

        7f8e1969b0874c8fb9ab44fc36575380

        SHA1

        3057c9ce90a23d29f7d0854472f9f44e87b0f09a

        SHA256

        076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd

        SHA512

        7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nszCFE4.tmp\nsDialogs.dll
        Filesize

        9KB

        MD5

        b7d61f3f56abf7b7ff0d4e7da3ad783d

        SHA1

        15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

        SHA256

        89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

        SHA512

        6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nszCFE4.tmp\nsExec.dll
        Filesize

        7KB

        MD5

        11092c1d3fbb449a60695c44f9f3d183

        SHA1

        b89d614755f2e943df4d510d87a7fc1a3bcf5a33

        SHA256

        2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

        SHA512

        c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nszCFE4.tmp\nsProcess.dll
        Filesize

        4KB

        MD5

        f0438a894f3a7e01a4aae8d1b5dd0289

        SHA1

        b058e3fcfb7b550041da16bf10d8837024c38bf6

        SHA256

        30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

        SHA512

        f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

        Download Submit

      • \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
        Filesize

        38KB

        MD5

        c10ccdec5d7af458e726a51bb3cdc732

        SHA1

        0553aab8c2106abb4120353360d747b0a2b4c94f

        SHA256

        589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

        SHA512

        7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

        Download Submit

      • \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
        Filesize

        10KB

        MD5

        f73ac62e8df97faf3fc8d83e7f71bf3f

        SHA1

        619a6e8f7a9803a4c71f73060649903606beaf4e

        SHA256

        cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

        SHA512

        f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

        Download Submit

      • memory/3732-548-0x0000000007BF0000-0x0000000007BFA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3732-518-0x0000000006160000-0x00000000061C6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/3732-546-0x0000000008230000-0x00000000088AA000-memory.dmp

        Filesize

        6.5MB

        Download

      • memory/3732-549-0x0000000007E00000-0x0000000007E96000-memory.dmp

        Filesize

        600KB

        Download

      • memory/3732-550-0x0000000007D80000-0x0000000007D91000-memory.dmp

        Filesize

        68KB

        Download

      • memory/3732-545-0x0000000007850000-0x00000000078F3000-memory.dmp

        Filesize

        652KB

        Download

      • memory/3732-544-0x0000000006E10000-0x0000000006E2E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/3732-551-0x0000000007DC0000-0x0000000007DCE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/3732-552-0x0000000007DD0000-0x0000000007DE4000-memory.dmp

        Filesize

        80KB

        Download

      • memory/3732-553-0x0000000007EC0000-0x0000000007EDA000-memory.dmp

        Filesize

        104KB

        Download

      • memory/3732-554-0x0000000007EA0000-0x0000000007EA8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/3732-515-0x0000000005290000-0x00000000052C6000-memory.dmp

        Filesize

        216KB

        Download

      • memory/3732-516-0x0000000005910000-0x0000000005F38000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/3732-534-0x000000006FB80000-0x000000006FBCC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/3732-533-0x0000000006E30000-0x0000000006E62000-memory.dmp

        Filesize

        200KB

        Download

      • memory/3732-517-0x0000000005F40000-0x0000000005F62000-memory.dmp

        Filesize

        136KB

        Download

      • memory/3732-519-0x00000000061D0000-0x0000000006236000-memory.dmp

        Filesize

        408KB

        Download

      • memory/3732-531-0x0000000006890000-0x00000000068DC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/3732-530-0x0000000006850000-0x000000000686E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/3732-529-0x0000000006340000-0x0000000006694000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/3732-547-0x0000000007B80000-0x0000000007B9A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4284-690-0x0000000005A50000-0x0000000005DA4000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/4284-689-0x0000000005960000-0x0000000005A12000-memory.dmp

        Filesize

        712KB

        Download

      • memory/4284-697-0x0000000006530000-0x0000000006A5C000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/4284-684-0x0000000005660000-0x000000000566A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4284-680-0x00000000056A0000-0x00000000056E6000-memory.dmp

        Filesize

        280KB

        Download

      • memory/4284-676-0x00000000052A0000-0x00000000052C4000-memory.dmp

        Filesize

        144KB

        Download

      • memory/4284-672-0x00000000007D0000-0x0000000000958000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/4908-24-0x0000000010000000-0x000000001019E000-memory.dmp

        Filesize

        1.6MB

        Download

      • memory/4952-734-0x0000000006B40000-0x0000000006B5A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4952-812-0x0000000040730000-0x00000000407D3000-memory.dmp

        Filesize

        652KB

        Download

      • memory/4952-733-0x0000000006B20000-0x0000000006B3E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4952-730-0x0000000006100000-0x0000000006454000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/4952-735-0x0000000006B70000-0x0000000006B7A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4952-736-0x0000000006BB0000-0x0000000006BD6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/4952-737-0x0000000006B60000-0x0000000006B68000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4952-738-0x0000000006B80000-0x0000000006B8A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4952-739-0x0000000006B90000-0x0000000006B9C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/4952-740-0x0000000030170000-0x000000003017A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4952-741-0x0000000030620000-0x0000000030646000-memory.dmp

        Filesize

        152KB

        Download

      • memory/4952-742-0x0000000030180000-0x0000000030190000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4952-762-0x000000003A180000-0x000000003A212000-memory.dmp

        Filesize

        584KB

        Download

      • memory/4952-766-0x000000003A7D0000-0x000000003AD74000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/4952-769-0x0000000039A80000-0x0000000039A88000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4952-771-0x000000003A730000-0x000000003A744000-memory.dmp

        Filesize

        80KB

        Download

      • memory/4952-772-0x000000003A140000-0x000000003A148000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4952-770-0x000000003A150000-0x000000003A162000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4952-775-0x000000003C220000-0x000000003C228000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4952-776-0x000000003CCC0000-0x000000003CE46000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/4952-779-0x000000003C990000-0x000000003C9C8000-memory.dmp

        Filesize

        224KB

        Download

      • memory/4952-780-0x000000003C960000-0x000000003C96E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4952-785-0x000000003CC30000-0x000000003CC42000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4952-786-0x000000003E0E0000-0x000000003E0FE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4952-789-0x000000003E2A0000-0x000000003E2B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4952-790-0x000000003E2F0000-0x000000003E306000-memory.dmp

        Filesize

        88KB

        Download

      • memory/4952-791-0x000000003E310000-0x000000003E320000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4952-801-0x000000003E540000-0x000000003E58A000-memory.dmp

        Filesize

        296KB

        Download

      • memory/4952-802-0x000000003F1C0000-0x000000003F20C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4952-731-0x0000000006990000-0x00000000069B2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4952-813-0x00000000409C0000-0x00000000409D1000-memory.dmp

        Filesize

        68KB

        Download

      • memory/4952-814-0x0000000040A80000-0x0000000040AF6000-memory.dmp

        Filesize

        472KB

        Download

      • memory/4952-815-0x0000000040B10000-0x0000000040B20000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4952-816-0x0000000040BB0000-0x0000000040BEA000-memory.dmp

        Filesize

        232KB

        Download

      • memory/4952-817-0x0000000001BA0000-0x0000000001BA8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/4952-818-0x0000000001BB0000-0x0000000001BC0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4952-819-0x000000003A240000-0x000000003A25E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4952-820-0x000000003DB40000-0x000000003DB72000-memory.dmp

        Filesize

        200KB

        Download

      • memory/4952-831-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4952-832-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-840-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-839-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4952-842-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4952-843-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-845-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-844-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4952-847-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-846-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4952-850-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-849-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4952-852-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-851-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4952-854-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-853-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4952-856-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-855-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4952-858-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-857-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download

      • memory/4952-860-0x000000006C140000-0x000000006C900000-memory.dmp

        Filesize

        7.8MB

        Download

      • memory/4952-859-0x000000006CDA0000-0x000000006D808000-memory.dmp

        Filesize

        10.4MB

        Download