Overview

overview

8

Static

static

3

2026-05-28...lc.exe

windows10-2004-x64

8

2026-05-28...lc.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/05/2026, 15:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-28_1cc0e048009216e4b5be0560b12c02ae_cryptbot_icedid_luca-stealer_njrat_stealc.exe
  • Size 17.5MB
  • Sample260528-tcfpmae191
  • SHA256 127f67b02599f8944e3561438fcd4c18b156c231222089520476511c3b1c08a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-28_1cc0e048009216e4b5be0560b12c02ae_cryptbot_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-28_1cc0e048009216e4b5be0560b12c02ae_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3812
    • C:\Users\Admin\AppData\Local\Temp\cf8e43e2.exe
      "C:\Users\Admin\AppData\Local\Temp\cf8e43e2.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2604
      • C:\Users\Admin\AppData\Local\Temp\cf8e43e2.exe
        "C:\Users\Admin\AppData\Local\Temp\cf8e43e2.exe"
        3⤵
        • Executes dropped EXE
        PID:3056
    • C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
      "C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2340
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        PID:2832
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1064
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious use of SetWindowsHookEx
        PID:4056
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4976
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3972
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1756
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4304
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3960
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2340
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1008
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsVPN
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4336
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe" checkNetFramework
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3516
        • C:\Program Files (x86)\letsvpn\app-3.19.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.19.0\LetsPRO.exe" checkNetFramework
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1504
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Program Files (x86)\letsvpn\app-3.19.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.19.0\LetsPRO.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Unexpected DNS network traffic destination
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C ipconfig /all
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3340
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:4836
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C route print
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5344
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:5388
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5416
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:5456
  • C:\Users\Admin\AppData\Local\Temp\cf8e43e2.exe
    C:\Users\Admin\AppData\Local\Temp\cf8e43e2.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4828
    • C:\Users\Admin\AppData\Local\Temp\cf8e43e2.exe
      "C:\Users\Admin\AppData\Local\Temp\cf8e43e2.exe"
      2⤵
      • Executes dropped EXE
      PID:5076
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{feace837-d793-4b49-b669-a3930e3e06d6}\oemvista.inf" "9" "4d14a44ff" "0000000000000138" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1776
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000138"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2404
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:4628
  • C:\Program Files (x86)\letsvpn\app-3.19.0\LetsPRO.exe
    "C:\Program Files (x86)\letsvpn\app-3.19.0\LetsPRO.exe" /silent
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2144
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
    1⤵
      PID:5528

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          2
          T1059

          PowerShell

          1
          T1059.001

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          2
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Network Service Discovery

          1
          T1046

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          6
          T1012

          System Information Discovery

          6
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AddWindowsSecurityExclusion.ps1
          • Path C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
          • Size 318B
          • SHA256 a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LetsPRO.exe
          • Path C:\Program Files (x86)\letsvpn\LetsPRO.exe
          • Size 243KB
          • SHA256 ecbeb1d02355f8897145d8c036e2ab44b73f86dd6a5eb361496de7c86fee7751
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CommunityToolkit.Mvvm.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\CommunityToolkit.Mvvm.dll
          • Size 110KB
          • SHA256 11b1add1db058d3760f52512e0ca911af726d7c049f25178446b6bd33d4eecd2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LetsPRO.exe
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\LetsPRO.exe
          • Size 1.7MB
          • SHA256 fb92185cd8d1d13f0fceba93e3efa02809c0f509b83a2e57e3276b9f9ca9d5d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LetsPRO.exe.config
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\LetsPRO.exe.config
          • Size 26KB
          • SHA256 0f077a25659096493c3d8044ccd99f4d65a00f611f8badaccd3f04dfbf958cd1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LetsVPNDomainModel.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\LetsVPNDomainModel.dll
          • Size 24KB
          • SHA256 87b92790f4e2223ff2fcad26a35b7ca3eb5af4046ab58444a5bd4351feee9ef7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\Newtonsoft.Json.dll
          • Size 695KB
          • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Memory.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\System.Memory.dll
          • Size 138KB
          • SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.CompilerServices.Unsafe.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\System.Runtime.CompilerServices.Unsafe.dll
          • Size 17KB
          • SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.InteropServices.RuntimeInformation.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\System.Runtime.InteropServices.RuntimeInformation.dll
          • Size 27KB
          • SHA256 8bb9d52ba5c67f05c8f632deb1e7e98a909318b10e1388b47e919515fdd42cbf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ValueTuple.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\System.ValueTuple.dll
          • Size 77KB
          • SHA256 e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Utils.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\Utils.dll
          • Size 135KB
          • SHA256 ef26e98db4f9a132fda88542cdcd633bd149fddc07efc99ac7042d294d258bf7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log4net.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.19.0\log4net.dll
          • Size 264KB
          • SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OemVista.inf
          • Path C:\Program Files (x86)\letsvpn\driver\OemVista.inf
          • Size 7KB
          • SHA256 150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tapinstall.exe
          • Path C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          • Size 99KB
          • SHA256 9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_dxdlcv54.pnx.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dxdlcv54.pnx.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          cf8e43e2.exe
          • Path C:\Users\Admin\AppData\Local\Temp\cf8e43e2.exe
          • Size 141KB
          • SHA256 06ff8cd364f2f0eef061c84452b8923045d31f591db810e7683aa0a72edf9397
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          letsvpn-latest.exe
          • Path C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
          • Size 16.6MB
          • SHA256 81dace7909dc032cfad0cf8e9c5aa25349225014ec3d71d744552d61e078cfa7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsb48DC.tmp\System.dll
          • Size 12KB
          • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modern-wizard.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nsb48DC.tmp\modern-wizard.bmp
          • Size 51KB
          • SHA256 076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsb48DC.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsb48DC.tmp\nsExec.dll
          • Size 7KB
          • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsb48DC.tmp\nsProcess.dll
          • Size 4KB
          • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1
          • Path C:\Users\Admin\AppData\Roaming\9BCD86C60000DABB\1
          • Size 137KB
          • SHA256 d4715ee0b28053eb3a7990d204c19ea367e7bfb19bb2315e0933219d714ddd73
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TIME
          • Path C:\Users\Admin\AppData\Roaming\9BCD86C60000DABB\TIME
          • Size 36B
          • SHA256 7a783824d326a37c2e1e78ef3d1af6fff415a5542f0ffb50acf3c6d5345ab8ce
          • MD5 SHA1 SHA512
          Submit Download

          tap0901.sys
          • Path \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
          • Size 38KB
          • SHA256 589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tap0901.cat
          • Path \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
          • Size 10KB
          • SHA256 cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1504-711-0x0000000005E50000-0x0000000005E5A000-memory.dmp
          Download

          memory/1504-697-0x00000000054B0000-0x0000000005562000-memory.dmp
          Download

          memory/1504-698-0x00000000055F0000-0x0000000005944000-memory.dmp
          Download

          memory/1504-689-0x00000000053A0000-0x00000000053E6000-memory.dmp
          Download

          memory/1504-702-0x0000000005C80000-0x0000000005C9E000-memory.dmp
          Download

          memory/1504-693-0x0000000004F40000-0x0000000004F4A000-memory.dmp
          Download

          memory/1504-703-0x0000000005DE0000-0x0000000005DFA000-memory.dmp
          Download

          memory/1504-685-0x0000000004F50000-0x0000000004F76000-memory.dmp
          Download

          memory/1504-681-0x00000000005C0000-0x0000000000778000-memory.dmp
          Download

          memory/1504-707-0x0000000005E20000-0x0000000005E36000-memory.dmp
          Download

          memory/1504-717-0x0000000005E70000-0x0000000005E78000-memory.dmp
          Download

          memory/1504-718-0x0000000005E80000-0x0000000005E8A000-memory.dmp
          Download

          memory/1504-715-0x0000000005E90000-0x0000000005EB6000-memory.dmp
          Download

          memory/1504-724-0x00000000066C0000-0x0000000006BEC000-memory.dmp
          Download

          memory/2040-773-0x0000000055AC0000-0x0000000055B0C000-memory.dmp
          Download

          memory/2040-799-0x0000000050D20000-0x0000000050D36000-memory.dmp
          Download

          memory/2040-821-0x000000006CE40000-0x000000006DBC4000-memory.dmp
          Download

          memory/2040-822-0x000000006BC50000-0x000000006C410000-memory.dmp
          Download

          memory/2040-819-0x000000006CE40000-0x000000006DBC4000-memory.dmp
          Download

          memory/2040-820-0x000000006BC50000-0x000000006C410000-memory.dmp
          Download

          memory/2040-817-0x000000006CE40000-0x000000006DBC4000-memory.dmp
          Download

          memory/2040-818-0x000000006BC50000-0x000000006C410000-memory.dmp
          Download

          memory/2040-815-0x000000006CE40000-0x000000006DBC4000-memory.dmp
          Download

          memory/2040-816-0x000000006BC50000-0x000000006C410000-memory.dmp
          Download

          memory/2040-813-0x000000006CE40000-0x000000006DBC4000-memory.dmp
          Download

          memory/2040-814-0x000000006BC50000-0x000000006C410000-memory.dmp
          Download

          memory/2040-811-0x000000006CE40000-0x000000006DBC4000-memory.dmp
          Download

          memory/2040-812-0x000000006BC50000-0x000000006C410000-memory.dmp
          Download

          memory/2040-809-0x000000006CE40000-0x000000006DBC4000-memory.dmp
          Download

          memory/2040-810-0x000000006BC50000-0x000000006C410000-memory.dmp
          Download

          memory/2040-807-0x000000006CE40000-0x000000006DBC4000-memory.dmp
          Download

          memory/2040-808-0x000000006BC50000-0x000000006C410000-memory.dmp
          Download

          memory/2040-804-0x000000006CE40000-0x000000006DBC4000-memory.dmp
          Download

          memory/2040-805-0x000000006BC50000-0x000000006C410000-memory.dmp
          Download

          memory/2040-798-0x0000000050CF0000-0x0000000050CFA000-memory.dmp
          Download

          memory/2040-797-0x0000000050CD0000-0x0000000050CE2000-memory.dmp
          Download

          memory/2040-796-0x0000000050E50000-0x0000000050E58000-memory.dmp
          Download

          memory/2040-795-0x0000000050E60000-0x0000000050E7E000-memory.dmp
          Download

          memory/2040-794-0x0000000050D90000-0x0000000050DA0000-memory.dmp
          Download

          memory/2040-793-0x0000000050D60000-0x0000000050D68000-memory.dmp
          Download

          memory/2040-792-0x0000000055DA0000-0x0000000055DDA000-memory.dmp
          Download

          memory/2040-791-0x0000000050B10000-0x0000000050B20000-memory.dmp
          Download

          memory/2040-738-0x0000000005290000-0x00000000055E4000-memory.dmp
          Download

          memory/2040-739-0x0000000005EE0000-0x0000000005F02000-memory.dmp
          Download

          memory/2040-740-0x0000000005EC0000-0x0000000005ECC000-memory.dmp
          Download

          memory/2040-742-0x0000000027030000-0x000000002703E000-memory.dmp
          Download

          memory/2040-751-0x0000000050620000-0x00000000506B2000-memory.dmp
          Download

          memory/2040-752-0x0000000052DA0000-0x0000000052DA8000-memory.dmp
          Download

          memory/2040-753-0x0000000052720000-0x0000000052758000-memory.dmp
          Download

          memory/2040-754-0x0000000052700000-0x000000005270E000-memory.dmp
          Download

          memory/2040-755-0x00000000539F0000-0x0000000053AA0000-memory.dmp
          Download

          memory/2040-756-0x0000000053AA0000-0x0000000053B22000-memory.dmp
          Download

          memory/2040-757-0x00000000539B0000-0x00000000539E2000-memory.dmp
          Download

          memory/2040-759-0x0000000053B50000-0x0000000053B66000-memory.dmp
          Download

          memory/2040-761-0x0000000053B40000-0x0000000053B4A000-memory.dmp
          Download

          memory/2040-760-0x0000000053B30000-0x0000000053B3A000-memory.dmp
          Download

          memory/2040-762-0x0000000053BB0000-0x0000000053BC2000-memory.dmp
          Download

          memory/2040-763-0x0000000054B00000-0x0000000054B1E000-memory.dmp
          Download

          memory/2040-771-0x0000000055EC0000-0x0000000056464000-memory.dmp
          Download

          memory/2040-772-0x0000000054FE0000-0x000000005502A000-memory.dmp
          Download

          memory/2040-789-0x000000006CE40000-0x000000006DBC4000-memory.dmp
          Download

          memory/2040-781-0x0000000050FC0000-0x0000000051063000-memory.dmp
          Download

          memory/2040-788-0x00000000510C0000-0x00000000510D1000-memory.dmp
          Download

          memory/2040-790-0x000000006BC50000-0x000000006C410000-memory.dmp
          Download

          memory/2340-544-0x0000000006930000-0x000000000694E000-memory.dmp
          Download

          memory/2340-561-0x0000000007F00000-0x0000000007F96000-memory.dmp
          Download

          memory/2340-565-0x0000000007FA0000-0x0000000007FBA000-memory.dmp
          Download

          memory/2340-564-0x0000000007EB0000-0x0000000007EC4000-memory.dmp
          Download

          memory/2340-563-0x0000000007EA0000-0x0000000007EAE000-memory.dmp
          Download

          memory/2340-562-0x0000000007E60000-0x0000000007E71000-memory.dmp
          Download

          memory/2340-543-0x00000000062C0000-0x0000000006614000-memory.dmp
          Download

          memory/2340-531-0x00000000032D0000-0x0000000003306000-memory.dmp
          Download

          memory/2340-566-0x0000000007EE0000-0x0000000007EE8000-memory.dmp
          Download

          memory/2340-532-0x0000000005B40000-0x0000000006168000-memory.dmp
          Download

          memory/2340-533-0x00000000058D0000-0x00000000058F2000-memory.dmp
          Download

          memory/2340-535-0x0000000006250000-0x00000000062B6000-memory.dmp
          Download

          memory/2340-560-0x0000000007CD0000-0x0000000007CDA000-memory.dmp
          Download

          memory/2340-534-0x00000000061E0000-0x0000000006246000-memory.dmp
          Download

          memory/2340-559-0x0000000007C80000-0x0000000007C9A000-memory.dmp
          Download

          memory/2340-545-0x00000000069C0000-0x0000000006A0C000-memory.dmp
          Download

          memory/2340-547-0x0000000006F00000-0x0000000006F32000-memory.dmp
          Download

          memory/2340-556-0x0000000006F40000-0x0000000006F5E000-memory.dmp
          Download

          memory/2340-548-0x000000006F900000-0x000000006F94C000-memory.dmp
          Download

          memory/2340-557-0x0000000007B20000-0x0000000007BC3000-memory.dmp
          Download

          memory/2340-558-0x0000000008300000-0x000000000897A000-memory.dmp
          Download

          memory/2604-44-0x00000246E97C0000-0x00000246E980D000-memory.dmp
          Download

          memory/2604-23-0x00000246E9320000-0x00000246E9322000-memory.dmp
          Download

          memory/2604-69-0x0000000180000000-0x0000000180056000-memory.dmp
          Download

          memory/2604-19-0x00000246E9320000-0x00000246E9322000-memory.dmp
          Download

          memory/2604-35-0x00000246E97C0000-0x00000246E980D000-memory.dmp
          Download

          memory/2604-39-0x00000246E9390000-0x00000246E940E000-memory.dmp
          Download

          memory/4828-57-0x000001FD02DA0000-0x000001FD02DED000-memory.dmp
          Download