26c54b1a0cb5d8636966e6f27505035b2521c7733ee8827b21a9a76f934665e7

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LetsVPN.exe
Size 27.5MB
Sample260704-plefpsfs9v
SHA256 26c54b1a0cb5d8636966e6f27505035b2521c7733ee8827b21a9a76f934665e7
MD5 bab942641669db23c43e76e650b83daf
SHA1 c8e7f905c57e0b4fc0d860ea997727f5cc2d00a3
SHA512 da33c04ac396a305ab8bbb699954a4e21fbe2f3a9904c1d4e40b05b8bff4a219b264865ea575dba04b65a56c5fd12ebbac604e653e85e5c0ae20ff2877f2f344
SSDEEP 786432:3kEolwYq4ZnrQ2JeD7gqo7mCmDpX8xdxpd:CAi7m7tsxpd
TLSH
T1E8573356D40F01E3E06500BD401F6496E18BBDAE6D32E7A2E641FFF6B93B91A44B710E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6284	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SETA498.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SETA498.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe

Executes dropped EXE 6 IoCs

pid	Process
6532	Microsoft.exe
4732	LetsPRO.exe
4796	LetsPRO.exe
6780	Microsoft.exe
6128	tapinstall.exe
5920	LetsPRO.exe

Loads dropped DLL 64 IoCs

pid	Process
6532	Microsoft.exe
6532	Microsoft.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
6780	Microsoft.exe
6780	Microsoft.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe
5920	LetsPRO.exe

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	6	119.29.29.29	4796	LetsPRO.exe
Destination IP	33	119.29.29.29	4796	LetsPRO.exe
Destination IP	44	119.29.29.29	4796	LetsPRO.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Windows\CurrentVersion\Run\LetsPRO = "\"C:\\ProgramData\\letss\\app-3.20.0\\LetsPRO.exe\" /silent"	LetsPRO.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
7128	cmd.exe
6880	ARP.EXE

Drops file in System32 directory 17 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{598fad57-d353-634e-bd18-4ebdc55c4a32}\SETA321.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{598fad57-d353-634e-bd18-4ebdc55c4a32}\oemvista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{598fad57-d353-634e-bd18-4ebdc55c4a32}\SETA323.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{598fad57-d353-634e-bd18-4ebdc55c4a32}\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{598fad57-d353-634e-bd18-4ebdc55c4a32}\SETA322.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{598fad57-d353-634e-bd18-4ebdc55c4a32}\SETA321.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{598fad57-d353-634e-bd18-4ebdc55c4a32}\SETA322.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{598fad57-d353-634e-bd18-4ebdc55c4a32}\tap0901.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{598fad57-d353-634e-bd18-4ebdc55c4a32}\SETA323.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\tap0901.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{598fad57-d353-634e-bd18-4ebdc55c4a32}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.PNF	tapinstall.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
6532	Microsoft.exe
6532	Microsoft.exe
6780	Microsoft.exe
6780	Microsoft.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	tapinstall.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LetsVPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LetsPRO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARP.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LetsPRO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LetsPRO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Microsoft.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ROUTE.EXE

Checks SCSI registry key(s) 3 TTPs 52 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	tapinstall.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	tapinstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	tapinstall.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5804	ipconfig.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\hnetcfgclient.dll,-201 = "HNetCfg Client"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\ = "letsvpn2Protocol"	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon\ = "\"C:\\ProgramData\\letss\\app-3.20.0\\LetsPRO.exe\",1"	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open\command\ = "\"C:\\ProgramData\\letss\\app-3.20.0\\LetsPRO.exe\" \"%1\""	LetsPRO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\URL Protocol = "C:\\ProgramData\\letss\\app-3.20.0\\LetsPRO.exe"	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\DefaultIcon	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\letsvpn2\shell\open	LetsPRO.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 6b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	LetsPRO.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff16b00000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf69200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	LetsPRO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	LetsPRO.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	LetsPRO.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	LetsPRO.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
6532	Microsoft.exe
6532	Microsoft.exe
6532	Microsoft.exe
6532	Microsoft.exe
6532	Microsoft.exe
6532	Microsoft.exe
6532	Microsoft.exe
6532	Microsoft.exe
6532	Microsoft.exe
6532	Microsoft.exe
6284	powershell.exe
6284	powershell.exe
6284	powershell.exe
6780	Microsoft.exe
6780	Microsoft.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	6284	powershell.exe
Token: SeDebugPrivilege	4796	LetsPRO.exe
Token: SeIncreaseQuotaPrivilege	6284	powershell.exe
Token: SeSecurityPrivilege	6284	powershell.exe
Token: SeTakeOwnershipPrivilege	6284	powershell.exe
Token: SeLoadDriverPrivilege	6284	powershell.exe
Token: SeSystemProfilePrivilege	6284	powershell.exe
Token: SeSystemtimePrivilege	6284	powershell.exe
Token: SeProfSingleProcessPrivilege	6284	powershell.exe
Token: SeIncBasePriorityPrivilege	6284	powershell.exe
Token: SeCreatePagefilePrivilege	6284	powershell.exe
Token: SeBackupPrivilege	6284	powershell.exe
Token: SeRestorePrivilege	6284	powershell.exe
Token: SeShutdownPrivilege	6284	powershell.exe
Token: SeDebugPrivilege	6284	powershell.exe
Token: SeSystemEnvironmentPrivilege	6284	powershell.exe
Token: SeRemoteShutdownPrivilege	6284	powershell.exe
Token: SeUndockPrivilege	6284	powershell.exe
Token: SeManageVolumePrivilege	6284	powershell.exe
Token: 33	6284	powershell.exe
Token: 34	6284	powershell.exe
Token: 35	6284	powershell.exe
Token: 36	6284	powershell.exe
Token: SeLoadDriverPrivilege	6128	tapinstall.exe
Token: SeRestorePrivilege	2232	DrvInst.exe
Token: SeBackupPrivilege	2232	DrvInst.exe
Token: SeLoadDriverPrivilege	2232	DrvInst.exe
Token: SeLoadDriverPrivilege	2232	DrvInst.exe
Token: SeLoadDriverPrivilege	2232	DrvInst.exe
Token: SeIncreaseQuotaPrivilege	4796	LetsPRO.exe
Token: SeSecurityPrivilege	4796	LetsPRO.exe
Token: SeTakeOwnershipPrivilege	4796	LetsPRO.exe
Token: SeLoadDriverPrivilege	4796	LetsPRO.exe
Token: SeSystemProfilePrivilege	4796	LetsPRO.exe
Token: SeSystemtimePrivilege	4796	LetsPRO.exe
Token: SeProfSingleProcessPrivilege	4796	LetsPRO.exe
Token: SeIncBasePriorityPrivilege	4796	LetsPRO.exe
Token: SeCreatePagefilePrivilege	4796	LetsPRO.exe
Token: SeBackupPrivilege	4796	LetsPRO.exe
Token: SeRestorePrivilege	4796	LetsPRO.exe
Token: SeShutdownPrivilege	4796	LetsPRO.exe
Token: SeDebugPrivilege	4796	LetsPRO.exe
Token: SeSystemEnvironmentPrivilege	4796	LetsPRO.exe
Token: SeRemoteShutdownPrivilege	4796	LetsPRO.exe
Token: SeUndockPrivilege	4796	LetsPRO.exe
Token: SeManageVolumePrivilege	4796	LetsPRO.exe
Token: 33	4796	LetsPRO.exe
Token: 34	4796	LetsPRO.exe
Token: 35	4796	LetsPRO.exe
Token: 36	4796	LetsPRO.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe
4796	LetsPRO.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 6532	4232	LetsVPN.exe	89
PID 4232 wrote to memory of 4732	4232	LetsVPN.exe	90
PID 4732 wrote to memory of 4796	4732	LetsPRO.exe	91
PID 6532 wrote to memory of 6552	6532	Microsoft.exe	94
PID 6532 wrote to memory of 6284	6532	Microsoft.exe	96
PID 4796 wrote to memory of 2552	4796	LetsPRO.exe	101
PID 2552 wrote to memory of 6128	2552	cmd.exe	103
PID 4796 wrote to memory of 4980	4796	LetsPRO.exe	113
PID 4980 wrote to memory of 5804	4980	cmd.exe	115
PID 4796 wrote to memory of 5904	4796	LetsPRO.exe	116
PID 5904 wrote to memory of 7148	5904	cmd.exe	118
PID 4796 wrote to memory of 7128	4796	LetsPRO.exe	119
PID 7128 wrote to memory of 6880	7128	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\LetsVPN.exe
"C:\Users\Admin\AppData\Local\Temp\LetsVPN.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232
- C:\ProgramData\letss\Microsoft.exe
  "C:\ProgramData\letss\Microsoft.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "MyAutoStartApp" /tr "C:\ProgramData\letss\Microsoft.exe" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6552
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\ProgramData\letss
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6284
- C:\ProgramData\letss\LetsPRO.exe
  "C:\ProgramData\letss\LetsPRO.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\ProgramData\letss\app-3.20.0\LetsPRO.exe
    "C:\ProgramData\letss\app-3.20.0\LetsPRO.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Unexpected DNS network traffic destination
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C ""C:\ProgramData\letss\driver\tapinstall.exe" install "C:\ProgramData\letss\driver\oemVista.inf" tap0901"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\ProgramData\letss\driver\tapinstall.exe
        
        "C:\ProgramData\letss\driver\tapinstall.exe" install "C:\ProgramData\letss\driver\oemVista.inf" tap0901
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Suspicious use of AdjustPrivilegeToken
        
        PID:6128
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C ipconfig /all
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4980
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /all
        5⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:5804
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C route print
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5904
    - - C:\Windows\SysWOW64\ROUTE.EXE
        
        route print
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7148
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C arp -a
      4⤵
      Network Service Discovery
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7128
    - - C:\Windows\SysWOW64\ARP.EXE
        
        arp -a
        5⤵
        Network Service Discovery
        System Location Discovery: System Language Discovery
        
        PID:6880

C:\ProgramData\letss\Microsoft.exe
C:\ProgramData\letss\Microsoft.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6780

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8ca3f931-f13f-4b4f-9f03-87f8253c1132}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000114" "208" "c:\programdata\letss\driver"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:6204

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.inf" "oem1.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000174" "3d15"
1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:5880

C:\ProgramData\letss\app-3.20.0\LetsPRO.exe
"C:\ProgramData\letss\app-3.20.0\LetsPRO.exe" /silent
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LetsPRO.exe

Path C:\ProgramData\letss\LetsPRO.exe
Size 243KB
SHA256 0e66192b248183324a6f3afc294e25299d096c5fbe9f99dc351613a1cf8d9d84
MD5 fb49018cd616909b9581551e7913535e
SHA1 2074d4eead8d3f637649c44042b70f6894ff64a3
SHA512 e5d8a4d65cc439cbca9d7fb3f9a8b4f5444a096e12197c840dea8c5b2b588049453a04a5f2554328208021ad31eb21d20671378a438d6aa47c7c0b39765b1054
SSDEEP 6144:xZzvhs2Z4n1E7g34XtVYAOfTd/z44JsQwuU7pI2:xJ+2Z4nShVY5JUUU1p
TLSH
T1B2348B1175D38472E5B30A3008F4E6B5AA7DFC710E659E7B63D9072E0F702C29A35EA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LetsPRO.ini

Path C:\ProgramData\letss\LetsPRO.ini
Size 1KB
SHA256 987b2c2cb1fd21c24e5572c9f9e367e9cd204d2c5d3805f7d2609442124d5b89
MD5 ad716272928f24a335a216afac6d83fe
SHA1 95aeb2b0c232ba25bf6f23bf18da3650b929e5ef
SHA512 768653811a29bab1232000ecb4a65d21f2d2ce0894116af7f075fff9781330a728d055cf96816f2e0482ed7b49fba274d85d599658db88ba232145ad8c87cb74
TLSH
T12631235742B02B31A4932117051FEB93B32469AC116B58B2346D8B843B47D39D36FDE9
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.exe

Path C:\ProgramData\letss\Microsoft.exe
Size 19KB
SHA256 10e990bbbda70da62c668908d0dbb4c9b21ffe95f186795c3a5ae98b5d302881
MD5 c2eae3fc9cc77cb893fcd450bc83e4d5
SHA1 d789a04335292b28e4cd6c9e70c318150cac4e1b
SHA512 8b2f7160318a1246ae3e5ba0806b63f2faced898bc03825cd055ba6dcaf718d8c703b1824a179fa72d1c6342e618944dbad0be53c3cdd96fe6efb5c5c63bac9f
SSDEEP 384:WlpXkFiG/kO+AxOfEHIYi9KL8E2AM+o/8E9VF0NyVYT9A:Wlp0FiSkHrMoYiDAMxkE0C
TLSH
T1F6927D63C9144C52DE4B8EB035FBDA2B99B677921A90C1C323AAC160CB553C1BAD51FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\ProgramData\letss\VCRUNTIME140.dll
Size 83KB
SHA256 b7c13f8519340257ba6ae3129afce961f137e394dde3e4e41971b9f912355f5e
MD5 b77eeaeaf5f8493189b89852f3a7a712
SHA1 c40cf51c2eadb070a570b969b0525dc3fb684339
SHA512 a09a1b60c9605969a30f99d3f6215d4bf923759b4057ba0a5375559234f17d47555a84268e340ffc9ad07e03d11f40dd1f3fb5da108d11eb7f7933b7d87f2de3
SSDEEP 1536:BTXU4YQD+JZoxeu8zIrBj3hGzHRb3izsQe1o8jsu0gD/TecbOjc8WsaBmiK:pXUlQDeexZTBozHRb3izsQe1o8E8ecbg
TLSH
T145837D11B4D84072D16A493412AEEA73763CAA608FD54FDF6FAC4C9C1AB93C1773221B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.Mvvm.dll

Path C:\ProgramData\letss\app-3.20.0\CommunityToolkit.Mvvm.dll
Size 110KB
SHA256 11b1add1db058d3760f52512e0ca911af726d7c049f25178446b6bd33d4eecd2
MD5 84b2d19fb23993251130999cd42563b8
SHA1 a169be412a7cf67fe190a6d484bb54df6ecdab75
SHA512 57a6ab3d3597cf3edf02d8a933ed82311bc5abf91361e2019d809093007470bd82f32df0ee10c39112bdb81fe447000f081b0022518c01ca71d81cca29f581eb
SSDEEP 1536:kARI0MvSAA6U7ks4jhOWE8i6wrNMRjYAZlfNASZfSOi32Xk:kWMpA6Agg8ahQYAZlFnUV
TLSH
T1F5B37D8163EC8A23D9FF1FBA64F450064B36E98BEA31E74E258C9AE105977C05C513B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INIFileParser.dll

Path C:\ProgramData\letss\app-3.20.0\INIFileParser.dll
Size 28KB
SHA256 f81ba0dd987d46a67b1879ef4ee11c14f32940ff211eace347a68e42bf272554
MD5 2e77f841dbf271fd1ffc460bfd87a1d5
SHA1 18125861f0519cdf643560c0a988bf70c87d47b3
SHA512 556e4133d28935c13d93e5190178804b13c98334332316ced50b878f35730b92c62f0440f1c2e1bc3f5c36eaeced5ca794cd2fdf9ad5434af6194940aed0e346
SSDEEP 768:3FBulP+gma9/YzvPtAlzIzlpAuJa2kIhW9:1B8yaWzvPtpAEa2kSQ
TLSH
T1ECD2F80127ECC33BC7AE4778F472125102F4EA5A7123DF4A9EAC60477E13B946A5636B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LetsGoogleAnalytics.dll

Path C:\ProgramData\letss\app-3.20.0\LetsGoogleAnalytics.dll
Size 7.6MB
SHA256 a23d411b195f1788f5860ced4101e382fa16ce99a1750cba7474872ad03bddd1
MD5 7144bc210567306f51628e40b1dba073
SHA1 edaf91449bbe189d6c3a9bc129714a98821a4c5f
SHA512 e0d40e619d97f476c3213917326391753cd2e228b2721669153c25a7c764477afb668958ef35d43fe7e086fe04dd7ed131d26af4699f53528ac449103b9df6cf
SSDEEP 98304:b1qq//2Zh39WUIKFE6gffcae/7ky9I83W2v:hqrIKaf0L7kyS83W2v
TLSH
T177863990FDDB00F5EA03157049AB627F67306E098B34CBC7DA44BF69EC37A960976219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LetsPRO.exe

Path C:\ProgramData\letss\app-3.20.0\LetsPRO.exe
Size 1.8MB
SHA256 88c4dd1f48b22285b65b1d5114a0a5ec1e636a04a6cf30fc6f489951b1781bd5
MD5 dacbf79fa3c898e6e4399de3399db4ed
SHA1 d469824cb7c85f303447b883ede38fdfd5ae2969
SHA512 aaa9c07cef1368e4a6d2864d03d846fd987e86fad70fc0145f14b35229021a2a51bfa2762b8ee564ebea3f66e29e519fa0ba6235158ad128b41a95985659df57
SSDEEP 24576:VYPkFVdzFDYJC8IGwaZAz6HH+Pa/AjHTwUVFKUY653o:VYuQJC86aZR+PukkEFbfK
TLSH
T11185AE00B1A1513EF46F77B2CA21C11C8F77BDC96661E21E90653A5E6CB2783CA2537B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LetsPRO.exe.config

Path C:\ProgramData\letss\app-3.20.0\LetsPRO.exe.config
Size 26KB
SHA256 bb087f73a88168851eacb2d538163d5253a9879bd1a0568717cb49e0009f5eca
MD5 c8ac520a6acdba6a888635f2eb14c38e
SHA1 831802e6f2d6718d4ba4167ab93f29f4a87be4c6
SHA512 f329dc4165667fe62aa105cdabb81b69c08d9d56448d8521ab19eca8604ee0d6845bb89142fce4e077d543999d7385e13579c0b862dbe1f5bc929a756bfc17a7
SSDEEP 192:xBrFw17YPccibxq1Kvqj3wY+yXX627ajpE69SZDhH1tW2:xDEYPMMURh2et79SZDhH1tW2
TLSH
T125C2CF2092E8BBA99F9215E23D7634244BAD0377298C419D70FD7D8BCF09DC666071BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LetsVPNDomainModel.dll

Path C:\ProgramData\letss\app-3.20.0\LetsVPNDomainModel.dll
Size 24KB
SHA256 bc8adbe29614f53b2a15b402f9b0f2d21613569cd040ea09f1c3e081806ca86e
MD5 3e6cec47470303e199d46331e1a02f0d
SHA1 9e9ff3079d753d1ba202a454f88649827fd88ddb
SHA512 3193ba55214a1aaad48772b682c26fa51829f435d8a8b5cd6e578da8a458f6b95730a11ec07f6a7a464843202cc1ea8316ff8fbca0783f821f501a093e26ae6a
SSDEEP 384:d8Kcv7wZWt+/Ae2QQsuhsWuFRBG5gzxvsuMTfNLbcrWB9ZV7:Iv7wZU+4ddTsTKcuTV+wN
TLSH
T1E6B207865BFC0102FBAF1FB5EAE556128D38FE411EFAC50F6005501F1C54B95AAB632B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LetsVPNInfraStructure.dll

Path C:\ProgramData\letss\app-3.20.0\LetsVPNInfraStructure.dll
Size 33KB
SHA256 463b487d5c30b1adc2694be635ad35f373fd5c2bb2b7d7671b96845af4a74c00
MD5 b84a9dc3f7a9449d6ef910ed43cd2433
SHA1 6e0f2b12361406d184b8b69884a43be908a5fdc4
SHA512 f17e93797a0846660cc05b26d3e8d4fb648e4a7ec00ea7da182140eecfbed887a948de54b915a1fcf8005f2d1a86ac6098f6f14217ca85c1448fd49d4a842691
SSDEEP 384:x3jYBpGWdbyZvwixumdFMvjsLuuJiy4f4WZ+bbshsWuFRBG5gzxvsBiTfNLbcrWF:x3jG0AbcoixxCu54f7iwsTKcpTV+wr
TLSH
T1C0F27D87BFE90743DEBE4ABA94D206021830F9855DA3D38B6356505A2F063D267FC399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\ProgramData\letss\app-3.20.0\Microsoft.Web.WebView2.Core.dll
Size 634KB
SHA256 fcc07f6b8ddb7c90915dbeaa2d959880bc52266dd49d7fab082f9da698f2bf0c
MD5 4b1eb3789190ad2ea2b4c55355ccf9f5
SHA1 8a2b1ed289b31a38f017b461a64b1744fa640fa1
SHA512 35ff527147e280bfc46fd4b8acef77b74a9c2e1219b1038532ab6f48af5e759b50915cf9bdc27cd2529bf4ab993a7d8b1556d8470c7e48239b7209495d95b016
SSDEEP 12288:gj5LLzRypN2KetpO4Rq4PjETh0SvY7YRqJ2GrO0APBULx/XwyqFRNAv6zrP322yw:o/wj7
TLSH
T19DD4302223FD4619F6F67FB55A780B608BFABC96B978D34E4598112D0D72F4099A0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\ProgramData\letss\app-3.20.0\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sentry.dll

Path C:\ProgramData\letss\app-3.20.0\Sentry.dll
Size 679KB
SHA256 b3da9268ac606fb39e7094e2203a5a30af2b681d98824ccecaee80462ca0f03a
MD5 ed26bd2e7a69fc2b65d60f9265b2eda1
SHA1 93eed8d96d1548bd4bdc0e722e6318a1db41048c
SHA512 d45da5c13be8bb7494acfe56440b9ca28202d69e56b68b75e84532ca3c19e91aed382b525b48d85fb43c2b48703f9a3a63250c853ff3e70dd9876fac09bd9ed6
SSDEEP 6144:TltPPMmYHq+muutGKJHw6krm0ZjfHeAFzdnt3VI7ZmvzAoXdpm7JuUJTpKVZH3L+:bPgm75WUZiH3L
TLSH
T124E42A8053F84B2AD5AE2B70F474558A8FB2F5067775EBCF5389A58E2C823838D50727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Buffers.dll

Path C:\ProgramData\letss\app-3.20.0\System.Buffers.dll
Size 20KB
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\ProgramData\letss\app-3.20.0\System.Memory.dll
Size 138KB
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\ProgramData\letss\app-3.20.0\System.Runtime.CompilerServices.Unsafe.dll
Size 17KB
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.RuntimeInformation.dll

Path C:\ProgramData\letss\app-3.20.0\System.Runtime.InteropServices.RuntimeInformation.dll
Size 27KB
SHA256 8bb9d52ba5c67f05c8f632deb1e7e98a909318b10e1388b47e919515fdd42cbf
MD5 568b53398bfc0e54aaf448b68f5c77c2
SHA1 76b0b6e65e38a90a4ecdb3f6dfe16d5a803081e9
SHA512 6052ee3664fd2095de3338cf6d24df022dc13d00b4bf14c57572f2a34ac078e07bd1f634a50028db0952ae8067ffcf19079177fa534240d9526f33ae1e1459ac
SSDEEP 384:OkUwx9rm5go1fWKmmW6oqN5eWjaWsFm0GftpBjZNaQHRN7ZtnlJCxJ:lrmoFmWdOMViLNLZhCb
TLSH
T1EED25B55DBFC8602EDDB0E7079B0E5876D3DEBC34D21AA2A0499E4881D973C86721F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ValueTuple.dll

Path C:\ProgramData\letss\app-3.20.0\System.ValueTuple.dll
Size 77KB
SHA256 e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f
MD5 8c9424e37a28db7d70e7d52f0df33cf8
SHA1 81cd1acb53d493c54c8d56f379d790a901a355ac
SHA512 cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4
SSDEEP 1536:6784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAPVGHMc:67NV8v36tI0XCKAt6
TLSH
T1CC73E92823583663C73E853318AA9AC75BB8D30BD746177B7DEAE5E818E1774B301274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Utils.dll

Path C:\ProgramData\letss\app-3.20.0\Utils.dll
Size 135KB
SHA256 d144d92dfab0fc0769ca08a605702ba5a2b660f04f6fe30fc719dabf8ba34b9e
MD5 ea9c35f2deac01c6e0571ca46b0b3db7
SHA1 0f740da00e85011f34ddd15ed8d208a75058e084
SHA512 3563de8149e9daa2db4f10e8c7ad0cdf1c1e92fb215525b5022b0de5e76e363a61f3b30e2042ed5d18b6bb6bd6bed525b8302daba08c5b28256364d069fdad02
SSDEEP 3072:HFKA7owY6mgYEG73ia2OzjWsBCW1Nt+Gs/yO8Bi1/Xg6iyhUkuWRapwm:lK9E7OzKIjpP
TLSH
T179D35B1037E80A05F2BFAF7995F451528B3AF94B6A56D74E0CD420EE1B727C28E1077A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwin.dll

Path C:\ProgramData\letss\app-3.20.0\libwin.dll
Size 13.3MB
SHA256 2acec651684e11db1c82229d4fb948a50d80a8d1adaefaecd2d43a9b9936a116
MD5 559fda0a9996d5a8949adfdf4bd84c04
SHA1 dbd1de87ff0db06d49b7b93d1c84456cd5b8776a
SHA512 261d417e9ebbbe0f9e01615b899b9ca4720cc525d65be2d58839d30c112a0f8789fc8f733e8b44cb507a36eda09e6a972bb0f79bc7bbf5878a5cbc02fa281e94
SSDEEP 98304:ioMguW78/DLVKV7c73+ejmUnoWKmgSX3kkEywI3S5ZdcrzqbZMy:PuW7k07c7nr/93kdyZWcib
TLSH
T1EAE61881FD8B44F6E9070831409BB32F27356D05CF28CBDBE7507A69F977AA21936285
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log4net.config

Path C:\ProgramData\letss\app-3.20.0\log4net.config
Size 1KB
SHA256 2a322178557c88cc3c608101e8fc84bfd2f8fa9b81483a443bb3d09779de218d
MD5 7a7521bc7f838610905ce0286324ce39
SHA1 8ab90dd0c4b6edb79a6af2233340d0f59e9ac195
SHA512 b25dfdce0977eaf7159df5eabe4b147a6c0adac39c84d1c7a9fe748446a10c8d2e20d04cf36221057aa210633df65f2a460821c8c79a2db16c912ec53a714d83
TLSH
T1C9313820FC6CFD01C61BDE579D322118C01FAA72362C79C9B0EAAC3F20AF570006C666
MD5 SHA1 SHA512 TLSH

Submit Download

log4net.dll

Path C:\ProgramData\letss\app-3.20.0\log4net.dll
Size 264KB
SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
MD5 27fe8d18682fd9901e589e65ef429b23
SHA1 6426e96243911beab547f2bc98a252a26692f11f
SHA512 9d6bc8c77c72cbad15e808281818c2768f1b44aa6ea1d54a979c91218b8fbf2a02fee49fa97db6cfa6087ddc363d6cdd6407e4494934b4568c514437030a2615
SSDEEP 3072:HG0WgexKpGi8PnJcerXUaxX3HVeES4BEIqTTpX/4ormGpnaVTSGCkMhkEn7GAhCj:HJrycoB3HVeESME3pnaVTS1nh7hCa
TLSH
T1C544195877F84A59F2FF2BB8A47644154BB5F816B87ED39E0A80A4EC2D33B108951373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\ProgramData\letss\app-3.20.0\runtimes\win-x86\native\WebView2Loader.dll
Size 117KB
SHA256 9873644f2668960d66e19d0c62f7812b1b3f35c1f53e8cd61edbb1be311666b0
MD5 cf0177234365051bcc159e0f5efc3cb4
SHA1 340dd30cacdb00bfbdd67b28c6bc9c7fc0f9fb7b
SHA512 a7ec5ad09110667e65cca5327c7fc3d3b025aa873d6f51e63b801b1c5ec81c240cfa54c56f7ca1dcc311f2ea83ac15c5c581997f71cbf46890d54f62ef529991
SSDEEP 3072:dXnSXunvjUnLGXBYeeesT2AIL9rF7A8TA/+XEtJIp1tl/Xd9kx:F+unL8ie5CXL++XEtJaXlfdW
TLSH
T123C37C00B5E48071E5AE55390838EAB65B3F7990DF609EEB379419BA4E353C09E34B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_frame.dll

Path C:\ProgramData\letss\cef_frame.dll
Size 11.1MB
SHA256 bebf82a8c111b7df421ede28994a8f7f61cfa23a943902736b8f1d08cb80a882
MD5 9566e4571ad9aa871caf9a5be091e490
SHA1 7f22db14e5bda5057b9e310aeb577fe033d45fe3
SHA512 8cd5ceec6e4ff90b8b86306c9e23c03a3a170df1f543e08fc5e1730747014d8e82ee60c9e3d70eb5d9299b538d3f3d703da02be4078d5c4104182de1dc80f077
SSDEEP 196608:OsyAafwQ7ONDdcEv3hILbEzd5B1Ueuqr3xmjMiBDV3kH:s1fwQ7OttvhIfYXDNWw
TLSH
T1CCC6339F39DF84E6DAC11C785B2B66E733B392E60CD64C3969C5380960E3FB62039456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_peueg5mg.hsv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_peueg5mg.hsv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

oemvista.inf_amd64_662fd96dfdced4ae.ini

Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae.ini
Size 418B
SHA256 d8e71ddac1ee45c125b80b737e71a889c907a72700148230dff045edd7291f7e
MD5 2d768f2c75f8e7cda6d3262ccb0a18ac
SHA1 b07622ea886dffae6ae14427cc6f77480bdeb008
SHA512 36e63a52fdbdd0ffe6291bf395ee616c15c29f6a05bdda5bf9d763e932ab59d80cf9e650293ef4bc366cc01565f3d6cb97d84b860c97a2b4bd59df0bf4acbff9
TLSH
T154E06D9924F7E29D61989D55A31A0CACA91A30249CDB1AC63B31A4C4EE83C1E9FD4753
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4232-290-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/4796-467-0x0000000057410000-0x0000000057420000-memory.dmp

Download

memory/4796-481-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-330-0x0000000006E80000-0x0000000006E96000-memory.dmp

Download

memory/4796-326-0x0000000006E60000-0x0000000006E7A000-memory.dmp

Download

memory/4796-325-0x0000000006E20000-0x0000000006E3E000-memory.dmp

Download

memory/4796-346-0x0000000006EF0000-0x0000000006EFA000-memory.dmp

Download

memory/4796-321-0x0000000006720000-0x0000000006A7B000-memory.dmp

Download

memory/4796-342-0x0000000006EE0000-0x0000000006EE8000-memory.dmp

Download

memory/4796-320-0x00000000066F0000-0x0000000006712000-memory.dmp

Download

memory/4796-338-0x0000000006F00000-0x0000000006F26000-memory.dmp

Download

memory/4796-348-0x0000000008030000-0x000000000855C000-memory.dmp

Download

memory/4796-349-0x0000000007B90000-0x0000000007BB2000-memory.dmp

Download

memory/4796-502-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-503-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-500-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-319-0x0000000006630000-0x00000000066E2000-memory.dmp

Download

memory/4796-358-0x0000000007B60000-0x0000000007B6C000-memory.dmp

Download

memory/4796-312-0x0000000006150000-0x00000000061F2000-memory.dmp

Download

memory/4796-313-0x0000000006200000-0x0000000006266000-memory.dmp

Download

memory/4796-309-0x00000000741C0000-0x000000007497C000-memory.dmp

Download

memory/4796-365-0x0000000028C50000-0x0000000028C5E000-memory.dmp

Download

memory/4796-307-0x0000000003660000-0x000000000366A000-memory.dmp

Download

memory/4796-376-0x00000000522E0000-0x0000000052372000-memory.dmp

Download

memory/4796-501-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-498-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-303-0x0000000006050000-0x0000000006096000-memory.dmp

Download

memory/4796-499-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-386-0x0000000052A90000-0x0000000052A98000-memory.dmp

Download

memory/4796-496-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-497-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-393-0x00000000529A0000-0x00000000529AE000-memory.dmp

Download

memory/4796-392-0x00000000529C0000-0x00000000529FE000-memory.dmp

Download

memory/4796-494-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-495-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-492-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-493-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-490-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-491-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-488-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-489-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-299-0x00000000035E0000-0x0000000003606000-memory.dmp

Download

memory/4796-486-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-487-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-416-0x0000000054880000-0x0000000054930000-memory.dmp

Download

memory/4796-484-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-417-0x0000000054930000-0x00000000549B2000-memory.dmp

Download

memory/4796-418-0x00000000547D0000-0x0000000054802000-memory.dmp

Download

memory/4796-421-0x0000000054830000-0x000000005483A000-memory.dmp

Download

memory/4796-422-0x0000000054840000-0x000000005484A000-memory.dmp

Download

memory/4796-420-0x0000000054850000-0x0000000054866000-memory.dmp

Download

memory/4796-423-0x0000000054A00000-0x0000000054A12000-memory.dmp

Download

memory/4796-294-0x0000000000FD0000-0x0000000001196000-memory.dmp

Download

memory/4796-436-0x00000000741D2000-0x00000000741D3000-memory.dmp

Download

memory/4796-435-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-434-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-437-0x00000000741C0000-0x000000007497C000-memory.dmp

Download

memory/4796-445-0x0000000056590000-0x00000000565DA000-memory.dmp

Download

memory/4796-444-0x0000000057AC0000-0x000000005807A000-memory.dmp

Download

memory/4796-446-0x0000000055D50000-0x0000000055D9C000-memory.dmp

Download

memory/4796-453-0x0000000056FF0000-0x0000000057093000-memory.dmp

Download

memory/4796-454-0x0000000057280000-0x000000005729E000-memory.dmp

Download

memory/4796-463-0x0000000052AD0000-0x0000000052AE1000-memory.dmp

Download

memory/4796-464-0x00000000570C0000-0x00000000570D0000-memory.dmp

Download

memory/4796-465-0x0000000059470000-0x00000000594AA000-memory.dmp

Download

memory/4796-466-0x0000000057270000-0x0000000057278000-memory.dmp

Download

memory/4796-293-0x00000000741D2000-0x00000000741D3000-memory.dmp

Download

memory/4796-468-0x0000000059430000-0x000000005944E000-memory.dmp

Download

memory/4796-469-0x0000000057430000-0x0000000057438000-memory.dmp

Download

memory/4796-471-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-470-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-473-0x0000000028E70000-0x0000000028E82000-memory.dmp

Download

memory/4796-474-0x0000000028E90000-0x0000000028E9A000-memory.dmp

Download

memory/4796-475-0x0000000028EC0000-0x0000000028ED6000-memory.dmp

Download

memory/4796-334-0x0000000006EC0000-0x0000000006ECA000-memory.dmp

Download

memory/4796-480-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-483-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/4796-482-0x000000006B920000-0x000000006C6A6000-memory.dmp

Download

memory/4796-485-0x000000006A8B0000-0x000000006B070000-memory.dmp

Download

memory/6284-402-0x0000000007190000-0x00000000071B0000-memory.dmp

Download

memory/6284-394-0x0000000007130000-0x0000000007166000-memory.dmp

Download

memory/6284-377-0x0000000002780000-0x00000000027B6000-memory.dmp

Download

memory/6284-395-0x0000000068E10000-0x0000000068E5C000-memory.dmp

Download

memory/6284-406-0x0000000007370000-0x000000000737A000-memory.dmp

Download

memory/6284-405-0x0000000007300000-0x000000000731A000-memory.dmp

Download

memory/6284-404-0x0000000007940000-0x0000000007FBC000-memory.dmp

Download

memory/6284-403-0x00000000071C0000-0x0000000007263000-memory.dmp

Download

memory/6284-378-0x0000000005220000-0x000000000586A000-memory.dmp

Download

memory/6284-379-0x0000000005990000-0x00000000059F6000-memory.dmp

Download

memory/6284-407-0x0000000007570000-0x0000000007606000-memory.dmp

Download

memory/6284-388-0x00000000060D0000-0x000000000611C000-memory.dmp

Download

memory/6284-387-0x0000000005FA0000-0x0000000005FBE000-memory.dmp

Download

memory/6532-352-0x000000006DFA0000-0x000000006F0FA000-memory.dmp

Download

memory/6532-351-0x00000000027A0000-0x00000000027A1000-memory.dmp

Download

memory/6532-350-0x0000000002790000-0x0000000002791000-memory.dmp

Download

memory/6780-411-0x000000006DFA0000-0x000000006F0FA000-memory.dmp

Download

memory/6780-409-0x0000000001170000-0x0000000001171000-memory.dmp

Download

memory/6780-410-0x0000000001180000-0x0000000001181000-memory.dmp

Download