Overview

overview

9

Static

static

3

Letspn_latest_64.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    299s
  • max time network
    302s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/09/2026, 10:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Letspn_latest_64.exe
  • Size 45.0MB
  • Sample260910-mwpy3sbk3y
  • SHA256 9aba970c5a0c5aa17d30720718a12c4bad31d826ef0e603c06c454d7b585fcde
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarethemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 64 IoCs
  • Themida packer 30 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Letspn_latest_64.exe
    "C:\Users\Admin\AppData\Local\Temp\Letspn_latest_64.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Users\Admin\AppData\Local\Temp\WinNetHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\WinNetHelper.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2552
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4728
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2752
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:676
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4532
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2968
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:412
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4584
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2344
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4616
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3608
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3280
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4612
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsVPN
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3128
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe" checkNetFramework
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1428
        • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe" checkNetFramework
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1840
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Unexpected DNS network traffic destination
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4760
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C ipconfig /all
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2132
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:3824
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C route print
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1648
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3252
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4404
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:1116
    • C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\GigabyteDownloadAssistant.exe
      "C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\GigabyteDownloadAssistant.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3792
  • C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\GigabyteDownloadAssistant.exe
    C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\GigabyteDownloadAssistant.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2224
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{dac675a3-9539-6544-98bc-48573b665c34}\oemvista.inf" "9" "4d14a44ff" "000000000000014C" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:5020
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000154" "e5aa"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:4492
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:1964
  • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
    "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe" /silent
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:4768

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        3
        T1059

        PowerShell

        1
        T1059.001

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Impair Defenses

        1
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Modify Registry

        2
        T1112

        Subvert Trust Controls

        1
        T1553

        Install Root Certificate

        1
        T1553.004

        Virtualization/Sandbox Evasion

        1
        T1497

        Credential Access

        Discovery

        Network Service Discovery

        1
        T1046

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        5
        T1012

        System Information Discovery

        5
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Virtualization/Sandbox Evasion

        1
        T1497

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AddWindowsSecurityExclusion.ps1
        • Path C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
        • Size 318B
        • SHA256 a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LetsPRO.exe
        • Path C:\Program Files (x86)\letsvpn\LetsPRO.exe
        • Size 243KB
        • SHA256 0e66192b248183324a6f3afc294e25299d096c5fbe9f99dc351613a1cf8d9d84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        CommunityToolkit.Mvvm.dll
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\CommunityToolkit.Mvvm.dll
        • Size 110KB
        • SHA256 11b1add1db058d3760f52512e0ca911af726d7c049f25178446b6bd33d4eecd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LetsPRO.exe
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
        • Size 1.8MB
        • SHA256 88c4dd1f48b22285b65b1d5114a0a5ec1e636a04a6cf30fc6f489951b1781bd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LetsPRO.exe.config
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe.config
        • Size 26KB
        • SHA256 bb087f73a88168851eacb2d538163d5253a9879bd1a0568717cb49e0009f5eca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LetsVPNDomainModel.dll
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsVPNDomainModel.dll
        • Size 24KB
        • SHA256 bc8adbe29614f53b2a15b402f9b0f2d21613569cd040ea09f1c3e081806ca86e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Web.WebView2.Core.dll
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Microsoft.Web.WebView2.Core.dll
        • Size 634KB
        • SHA256 fcc07f6b8ddb7c90915dbeaa2d959880bc52266dd49d7fab082f9da698f2bf0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Newtonsoft.Json.dll
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Newtonsoft.Json.dll
        • Size 695KB
        • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.RuntimeInformation.dll
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\System.Runtime.InteropServices.RuntimeInformation.dll
        • Size 27KB
        • SHA256 8bb9d52ba5c67f05c8f632deb1e7e98a909318b10e1388b47e919515fdd42cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ValueTuple.dll
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\System.ValueTuple.dll
        • Size 77KB
        • SHA256 e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Utils.dll
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Utils.dll
        • Size 135KB
        • SHA256 d144d92dfab0fc0769ca08a605702ba5a2b660f04f6fe30fc719dabf8ba34b9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        log4net.dll
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\log4net.dll
        • Size 264KB
        • SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WebView2Loader.dll
        • Path C:\Program Files (x86)\letsvpn\app-3.20.0\runtimes\win-x86\native\WebView2Loader.dll
        • Size 117KB
        • SHA256 9873644f2668960d66e19d0c62f7812b1b3f35c1f53e8cd61edbb1be311666b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OemVista.inf
        • Path C:\Program Files (x86)\letsvpn\driver\OemVista.inf
        • Size 7KB
        • SHA256 150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tapinstall.exe
        • Path C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        • Size 99KB
        • SHA256 9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GigabyteDownloadAssistant.exe
        • Path C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\GigabyteDownloadAssistant.exe
        • Size 610KB
        • SHA256 7e07a64d95b1669008014a9c594a253021f01ab0f54ec6268bde1fb743e6cec7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qbcore.dll
        • Path C:\ProgramData\GIGABYTE\GigabyteDownloadAssistant\qbcore.dll
        • Size 4.3MB
        • SHA256 8b2594dac6ed989b1713bc42645cdc4cbc1d7821fda3fe7cd292e989128479df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WinNetHelper.exe
        • Path C:\Users\Admin\AppData\Local\Temp\WinNetHelper.exe
        • Size 16.7MB
        • SHA256 796640f54bdad0f8a77fdde41ef8d15bde06cc5e1d6920159ebd8ab06a0e4bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_2gvdkyaq.qmy.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2gvdkyaq.qmy.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd3322.tmp\System.dll
        • Size 12KB
        • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        modern-wizard.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\nsd3322.tmp\modern-wizard.bmp
        • Size 51KB
        • SHA256 076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsDialogs.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd3322.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsExec.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd3322.tmp\nsExec.dll
        • Size 7KB
        • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsProcess.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsd3322.tmp\nsProcess.dll
        • Size 4KB
        • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tap0901.sys
        • Path \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
        • Size 38KB
        • SHA256 589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tap0901.cat
        • Path \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
        • Size 10KB
        • SHA256 cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1840-694-0x0000000006C50000-0x0000000006C5A000-memory.dmp
        Download

        memory/1840-687-0x0000000006AB0000-0x0000000006ACA000-memory.dmp
        Download

        memory/1840-696-0x0000000006C60000-0x0000000006C68000-memory.dmp
        Download

        memory/1840-697-0x0000000006C70000-0x0000000006C7A000-memory.dmp
        Download

        memory/1840-691-0x0000000006C30000-0x0000000006C46000-memory.dmp
        Download

        memory/1840-678-0x00000000064B0000-0x0000000006807000-memory.dmp
        Download

        memory/1840-677-0x00000000063C0000-0x0000000006472000-memory.dmp
        Download

        memory/1840-666-0x0000000005DA0000-0x0000000005E42000-memory.dmp
        Download

        memory/1840-695-0x0000000006C90000-0x0000000006CB6000-memory.dmp
        Download

        memory/1840-662-0x0000000005A10000-0x0000000005A1A000-memory.dmp
        Download

        memory/1840-686-0x0000000006A70000-0x0000000006A8E000-memory.dmp
        Download

        memory/1840-658-0x0000000005CA0000-0x0000000005CE6000-memory.dmp
        Download

        memory/1840-654-0x00000000032C0000-0x00000000032E6000-memory.dmp
        Download

        memory/1840-650-0x0000000000DC0000-0x0000000000F86000-memory.dmp
        Download

        memory/1840-698-0x00000000074A0000-0x00000000079CC000-memory.dmp
        Download

        memory/2224-812-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-535-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-830-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-788-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-43-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-54-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-824-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-741-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-821-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-818-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-777-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-52-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-815-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-827-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-809-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-806-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-791-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-46-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-47-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-49-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-803-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-800-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-797-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2224-794-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/2596-40-0x00000000001F0000-0x0000000002F0D000-memory.dmp
        Download

        memory/3792-45-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/3792-44-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/3792-51-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/3792-48-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/3792-50-0x000000022F180000-0x000000022FF5C000-memory.dmp
        Download

        memory/4728-539-0x0000000007F50000-0x0000000007F5E000-memory.dmp
        Download

        memory/4728-536-0x0000000005750000-0x000000000575A000-memory.dmp
        Download

        memory/4728-519-0x00000000063A0000-0x00000000066F7000-memory.dmp
        Download

        memory/4728-509-0x0000000005BD0000-0x00000000061FA000-memory.dmp
        Download

        memory/4728-511-0x0000000006200000-0x0000000006266000-memory.dmp
        Download

        memory/4728-542-0x0000000008040000-0x0000000008048000-memory.dmp
        Download

        memory/4728-541-0x0000000008050000-0x000000000806A000-memory.dmp
        Download

        memory/4728-540-0x0000000007F60000-0x0000000007F75000-memory.dmp
        Download

        memory/4728-508-0x00000000033B0000-0x00000000033E6000-memory.dmp
        Download

        memory/4728-538-0x0000000007F20000-0x0000000007F31000-memory.dmp
        Download

        memory/4728-537-0x0000000007F90000-0x0000000008026000-memory.dmp
        Download

        memory/4728-510-0x0000000005AE0000-0x0000000005B02000-memory.dmp
        Download

        memory/4728-534-0x0000000007C00000-0x0000000007C1A000-memory.dmp
        Download

        memory/4728-533-0x0000000008260000-0x00000000088DA000-memory.dmp
        Download

        memory/4728-532-0x00000000078C0000-0x0000000007964000-memory.dmp
        Download

        memory/4728-531-0x0000000007840000-0x000000000785E000-memory.dmp
        Download

        memory/4728-524-0x000000006F9F0000-0x000000006FA3C000-memory.dmp
        Download

        memory/4728-523-0x0000000007880000-0x00000000078B4000-memory.dmp
        Download

        memory/4728-512-0x0000000006330000-0x0000000006396000-memory.dmp
        Download

        memory/4728-521-0x00000000068D0000-0x000000000691C000-memory.dmp
        Download

        memory/4728-520-0x0000000006880000-0x000000000689E000-memory.dmp
        Download

        memory/4760-719-0x00000000077F0000-0x00000000077FE000-memory.dmp
        Download

        memory/4760-749-0x00000000518B0000-0x00000000518C0000-memory.dmp
        Download

        memory/4760-750-0x0000000051940000-0x000000005198A000-memory.dmp
        Download

        memory/4760-751-0x0000000051C30000-0x0000000051C6A000-memory.dmp
        Download

        memory/4760-752-0x0000000055FF0000-0x0000000055FF8000-memory.dmp
        Download

        memory/4760-753-0x0000000056150000-0x0000000056160000-memory.dmp
        Download

        memory/4760-754-0x0000000056210000-0x000000005622E000-memory.dmp
        Download

        memory/4760-755-0x0000000056010000-0x0000000056018000-memory.dmp
        Download

        memory/4760-756-0x0000000056160000-0x00000000561AC000-memory.dmp
        Download

        memory/4760-763-0x000000005A7A0000-0x000000005A844000-memory.dmp
        Download

        memory/4760-774-0x000000005A850000-0x000000005A861000-memory.dmp
        Download

        memory/4760-776-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-775-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-748-0x0000000056AC0000-0x0000000057066000-memory.dmp
        Download

        memory/4760-780-0x0000000055700000-0x0000000055716000-memory.dmp
        Download

        memory/4760-779-0x00000000065D0000-0x00000000065DA000-memory.dmp
        Download

        memory/4760-778-0x0000000054120000-0x0000000054132000-memory.dmp
        Download

        memory/4760-786-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-785-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-740-0x0000000055250000-0x000000005526E000-memory.dmp
        Download

        memory/4760-790-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-789-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-739-0x0000000054500000-0x0000000054512000-memory.dmp
        Download

        memory/4760-793-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-792-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-736-0x00000000544A0000-0x00000000544B6000-memory.dmp
        Download

        memory/4760-796-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-795-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-737-0x00000000542F0000-0x00000000542FA000-memory.dmp
        Download

        memory/4760-799-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-798-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-738-0x0000000054480000-0x000000005448A000-memory.dmp
        Download

        memory/4760-802-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-801-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-734-0x0000000054440000-0x0000000054472000-memory.dmp
        Download

        memory/4760-805-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-804-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-732-0x0000000054300000-0x00000000543B0000-memory.dmp
        Download

        memory/4760-808-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-807-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-733-0x00000000543B0000-0x0000000054432000-memory.dmp
        Download

        memory/4760-811-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-810-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-731-0x0000000052FC0000-0x0000000052FCE000-memory.dmp
        Download

        memory/4760-814-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-813-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-730-0x0000000052FE0000-0x0000000053018000-memory.dmp
        Download

        memory/4760-817-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-816-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-729-0x0000000053060000-0x0000000053068000-memory.dmp
        Download

        memory/4760-820-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-819-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-728-0x00000000511E0000-0x0000000051272000-memory.dmp
        Download

        memory/4760-823-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-822-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-717-0x0000000006B80000-0x0000000006B8C000-memory.dmp
        Download

        memory/4760-826-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-825-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-716-0x0000000006BB0000-0x0000000006BD2000-memory.dmp
        Download

        memory/4760-829-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-828-0x000000006C980000-0x000000006D706000-memory.dmp
        Download

        memory/4760-715-0x0000000006060000-0x00000000063B7000-memory.dmp
        Download

        memory/4760-832-0x000000006B740000-0x000000006BF00000-memory.dmp
        Download

        memory/4760-831-0x000000006C980000-0x000000006D706000-memory.dmp
        Download