Overview

overview

9

Static

static

5

2026-08-02...lc.exe

windows10-2004-x64

9

2026-08-02...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/08/2026, 03:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_993a376269fd2ea1e19a14bb66857d20_icedid_stealc.exe
  • Size 117.3MB
  • Sample260803-drfeeabd82
  • SHA256 623853a0ff07529832af9434634d5732171416467d46dc289b8fdceeb5b54101
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 7 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    defense_evasion
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_993a376269fd2ea1e19a14bb66857d20_icedid_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_993a376269fd2ea1e19a14bb66857d20_icedid_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Users\Admin\AppData\Local\Temp\a607d0667fb2.exe
      "C:\Users\Admin\AppData\Local\Temp\a607d0667fb2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3572
      • C:\Users\Public\u5o33t6v8q\active_desktop_launcher_x64.exe
        "C:\Users\Public\u5o33t6v8q\active_desktop_launcher_x64.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4520
    • C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
      "C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4572
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:1676
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:768
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4028
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2900
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2060
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2696
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:696
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:220
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5048
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsVPN
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:780
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe" checkNetFramework
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4760
        • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe" checkNetFramework
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1392
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4284
        • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Unexpected DNS network traffic destination
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3152
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C ipconfig /all
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4412
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:4536
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C route print
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3900
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:1184
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4848
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:2900
  • C:\Users\Public\u5o33t6v8q\active_desktop_launcher_x64.exe
    C:\Users\Public\u5o33t6v8q\active_desktop_launcher_x64.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4988
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7d949c3b-1841-be4c-9b15-2179e8a9ae41}\oemvista.inf" "9" "4d14a44ff" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "c:\program files (x86)\letsvpn\driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4772
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000150"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1120
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:2184
  • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
    "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe" /silent
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:1704
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
    1⤵
      PID:4612

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          3
          T1059

          PowerShell

          1
          T1059.001

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          2
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Network Service Discovery

          1
          T1046

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Remote Services

          1
          T1021

          Remote Desktop Protocol

          1
          T1021.001

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AddWindowsSecurityExclusion.ps1
          • Path C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
          • Size 318B
          • SHA256 a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LetsPRO.exe
          • Path C:\Program Files (x86)\letsvpn\LetsPRO.exe
          • Size 243KB
          • SHA256 0e66192b248183324a6f3afc294e25299d096c5fbe9f99dc351613a1cf8d9d84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LetsPRO.exe
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
          • Size 1.8MB
          • SHA256 88c4dd1f48b22285b65b1d5114a0a5ec1e636a04a6cf30fc6f489951b1781bd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LetsPRO.exe.config
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe.config
          • Size 26KB
          • SHA256 bb087f73a88168851eacb2d538163d5253a9879bd1a0568717cb49e0009f5eca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LetsVPNDomainModel.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsVPNDomainModel.dll
          • Size 24KB
          • SHA256 bc8adbe29614f53b2a15b402f9b0f2d21613569cd040ea09f1c3e081806ca86e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Web.WebView2.Core.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Microsoft.Web.WebView2.Core.dll
          • Size 634KB
          • SHA256 fcc07f6b8ddb7c90915dbeaa2d959880bc52266dd49d7fab082f9da698f2bf0c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Newtonsoft.Json.dll
          • Size 695KB
          • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Utils.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Utils.dll
          • Size 135KB
          • SHA256 d144d92dfab0fc0769ca08a605702ba5a2b660f04f6fe30fc719dabf8ba34b9e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log4net.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\log4net.dll
          • Size 264KB
          • SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WebView2Loader.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\runtimes\win-x86\native\WebView2Loader.dll
          • Size 117KB
          • SHA256 9873644f2668960d66e19d0c62f7812b1b3f35c1f53e8cd61edbb1be311666b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OemVista.inf
          • Path C:\Program Files (x86)\letsvpn\driver\OemVista.inf
          • Size 7KB
          • SHA256 150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tapinstall.exe
          • Path C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          • Size 99KB
          • SHA256 9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1
          • Path C:\ProgramData\E374A4A30000BA96\1
          • Size 255KB
          • SHA256 5e77836abedd2e236207a18dbcefb42e7002d3ace3c65abd1b316f817d9ca092
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GROUP
          • Path C:\ProgramData\E374A4A30000BA96\GROUP
          • Size 4B
          • SHA256 b1441fb610c44a4cf71233b0f3f75fb1f47193005b3ea33f6b6259b1448c918b
          • MD5 SHA1 SHA512
          Submit Download

          INSTALL_TIME
          • Path C:\ProgramData\E374A4A30000BA96\INSTALL_TIME
          • Size 38B
          • SHA256 2ecb77bfe9ad07552a9f6640094e0f0427e5009ce26d51bd06a6ea373f79adb1
          • MD5 SHA1 SHA512
          Submit Download

          index.dat
          • Path C:\ProgramData\E374A4A30000BA96\Modules\x64\index.dat
          • Size 20B
          • SHA256 a36e64842adb43b357820cfb54bcd3ae64fc4cbe3d4ef1414f4f62386026b98f
          • MD5 SHA1 SHA512
          Submit Download

          index.dat
          • Path C:\ProgramData\E374A4A30000BA96\Modules\x64\index.dat
          • Size 20B
          • SHA256 d2fddb7e5ed5a81cca8956ed2e11d7963de05ebbf317967261b20be9ecb4a667
          • MD5 SHA1 SHA512
          Submit Download

          REMARK
          • Path C:\ProgramData\E374A4A30000BA96\REMARK
          • Size 6B
          • SHA256 f3fb9e94f813be2cc4fb1d38777634a8dc079600027b5d19cd373ed21e327347
          • MD5 SHA1 SHA512
          Submit Download

          __PSScriptPolicyTest_rorki4d5.l4z.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rorki4d5.l4z.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          letsvpn-latest.exe
          • Path C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
          • Size 16.7MB
          • SHA256 796640f54bdad0f8a77fdde41ef8d15bde06cc5e1d6920159ebd8ab06a0e4bc9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsk6B3.tmp\System.dll
          • Size 12KB
          • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modern-wizard.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nsk6B3.tmp\modern-wizard.bmp
          • Size 51KB
          • SHA256 076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsk6B3.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsk6B3.tmp\nsExec.dll
          • Size 7KB
          • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nsk6B3.tmp\nsProcess.dll
          • Size 4KB
          • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          active_desktop_launcher_x64.exe
          • Path C:\Users\Public\u5o33t6v8q\active_desktop_launcher_x64.exe
          • Size 100KB
          • SHA256 f712c2a8b4abf2e299a2b480020333deb0f43364e9686cda78b1243c62e4830d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          active_desktop_render_x64.dll
          • Path C:\Users\Public\u5o33t6v8q\active_desktop_render_x64.dll
          • Size 107KB
          • SHA256 1e378328734e9af73e1133fd04eaf7f5085132c5bc06a9d166550486ec6d9b66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          utbryiti.ini
          • Path C:\Users\Public\u5o33t6v8q\utbryiti.ini
          • Size 17KB
          • SHA256 e58fdb9b86c0aaf2502068dcc48cca7326476c9cca9c29b537184a21fbdf17ab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tap0901.sys
          • Path \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
          • Size 38KB
          • SHA256 589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tap0901.cat
          • Path \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
          • Size 10KB
          • SHA256 cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1392-677-0x0000000005D30000-0x0000000005D3A000-memory.dmp
          Download

          memory/1392-710-0x0000000007470000-0x000000000799C000-memory.dmp
          Download

          memory/1392-708-0x0000000006C30000-0x0000000006C38000-memory.dmp
          Download

          memory/1392-707-0x0000000006C60000-0x0000000006C86000-memory.dmp
          Download

          memory/1392-696-0x0000000006480000-0x00000000067D4000-memory.dmp
          Download

          memory/1392-673-0x0000000005D70000-0x0000000005DB6000-memory.dmp
          Download

          memory/1392-709-0x0000000006C50000-0x0000000006C5A000-memory.dmp
          Download

          memory/1392-681-0x0000000005EB0000-0x0000000005F52000-memory.dmp
          Download

          memory/1392-669-0x0000000005950000-0x0000000005976000-memory.dmp
          Download

          memory/1392-665-0x0000000000FA0000-0x0000000001166000-memory.dmp
          Download

          memory/1392-706-0x0000000006C20000-0x0000000006C2A000-memory.dmp
          Download

          memory/1392-702-0x0000000006C00000-0x0000000006C16000-memory.dmp
          Download

          memory/1392-701-0x0000000006BC0000-0x0000000006BDA000-memory.dmp
          Download

          memory/1392-700-0x0000000006A40000-0x0000000006A5E000-memory.dmp
          Download

          memory/1392-695-0x0000000006360000-0x0000000006412000-memory.dmp
          Download

          memory/3152-761-0x0000000051F50000-0x0000000051F9C000-memory.dmp
          Download

          memory/3152-786-0x0000000055E80000-0x0000000055E88000-memory.dmp
          Download

          memory/3152-811-0x000000006D1D0000-0x000000006DF56000-memory.dmp
          Download

          memory/3152-812-0x000000006C000000-0x000000006C7C0000-memory.dmp
          Download

          memory/3152-809-0x000000006D1D0000-0x000000006DF56000-memory.dmp
          Download

          memory/3152-810-0x000000006C000000-0x000000006C7C0000-memory.dmp
          Download

          memory/3152-807-0x000000006D1D0000-0x000000006DF56000-memory.dmp
          Download

          memory/3152-808-0x000000006C000000-0x000000006C7C0000-memory.dmp
          Download

          memory/3152-805-0x000000006D1D0000-0x000000006DF56000-memory.dmp
          Download

          memory/3152-806-0x000000006C000000-0x000000006C7C0000-memory.dmp
          Download

          memory/3152-803-0x000000006D1D0000-0x000000006DF56000-memory.dmp
          Download

          memory/3152-804-0x000000006C000000-0x000000006C7C0000-memory.dmp
          Download

          memory/3152-801-0x000000006D1D0000-0x000000006DF56000-memory.dmp
          Download

          memory/3152-802-0x000000006C000000-0x000000006C7C0000-memory.dmp
          Download

          memory/3152-799-0x000000006D1D0000-0x000000006DF56000-memory.dmp
          Download

          memory/3152-800-0x000000006C000000-0x000000006C7C0000-memory.dmp
          Download

          memory/3152-797-0x000000006D1D0000-0x000000006DF56000-memory.dmp
          Download

          memory/3152-798-0x000000006C000000-0x000000006C7C0000-memory.dmp
          Download

          memory/3152-790-0x0000000054570000-0x000000005457A000-memory.dmp
          Download

          memory/3152-791-0x00000000545C0000-0x00000000545D6000-memory.dmp
          Download

          memory/3152-789-0x0000000054580000-0x0000000054592000-memory.dmp
          Download

          memory/3152-787-0x000000006D1D0000-0x000000006DF56000-memory.dmp
          Download

          memory/3152-788-0x000000006C000000-0x000000006C7C0000-memory.dmp
          Download

          memory/3152-785-0x0000000055EA0000-0x0000000055EBE000-memory.dmp
          Download

          memory/3152-783-0x0000000055E30000-0x0000000055E38000-memory.dmp
          Download

          memory/3152-784-0x0000000055E70000-0x0000000055E80000-memory.dmp
          Download

          memory/3152-782-0x0000000057180000-0x00000000571BA000-memory.dmp
          Download

          memory/3152-781-0x0000000051FE0000-0x0000000051FF0000-memory.dmp
          Download

          memory/3152-779-0x000000006D1D0000-0x000000006DF56000-memory.dmp
          Download

          memory/3152-780-0x000000006C000000-0x000000006C7C0000-memory.dmp
          Download

          memory/3152-726-0x00000000062F0000-0x0000000006644000-memory.dmp
          Download

          memory/3152-727-0x0000000006E30000-0x0000000006E52000-memory.dmp
          Download

          memory/3152-728-0x0000000006E00000-0x0000000006E0C000-memory.dmp
          Download

          memory/3152-730-0x0000000028140000-0x000000002814E000-memory.dmp
          Download

          memory/3152-739-0x00000000515B0000-0x0000000051642000-memory.dmp
          Download

          memory/3152-740-0x0000000053710000-0x0000000053718000-memory.dmp
          Download

          memory/3152-741-0x0000000053680000-0x00000000536B8000-memory.dmp
          Download

          memory/3152-742-0x0000000053660000-0x000000005366E000-memory.dmp
          Download

          memory/3152-743-0x00000000547D0000-0x0000000054880000-memory.dmp
          Download

          memory/3152-744-0x0000000054880000-0x0000000054902000-memory.dmp
          Download

          memory/3152-745-0x0000000054780000-0x00000000547B2000-memory.dmp
          Download

          memory/3152-747-0x0000000054940000-0x0000000054956000-memory.dmp
          Download

          memory/3152-749-0x0000000054930000-0x000000005493A000-memory.dmp
          Download

          memory/3152-748-0x0000000054920000-0x000000005492A000-memory.dmp
          Download

          memory/3152-750-0x00000000549B0000-0x00000000549C2000-memory.dmp
          Download

          memory/3152-751-0x00000000558A0000-0x00000000558BE000-memory.dmp
          Download

          memory/3152-759-0x0000000056B50000-0x00000000570F4000-memory.dmp
          Download

          memory/3152-760-0x0000000051940000-0x000000005198A000-memory.dmp
          Download

          memory/3152-778-0x0000000056300000-0x0000000056311000-memory.dmp
          Download

          memory/3152-769-0x0000000056020000-0x00000000560C3000-memory.dmp
          Download

          memory/4520-69-0x0000026206360000-0x000002620640E000-memory.dmp
          Download

          memory/4520-31-0x0000026204300000-0x0000026204305000-memory.dmp
          Download

          memory/4520-45-0x0000026206360000-0x000002620640E000-memory.dmp
          Download

          memory/4520-47-0x0000026206360000-0x000002620640E000-memory.dmp
          Download

          memory/4520-51-0x0000026206360000-0x000002620640E000-memory.dmp
          Download

          memory/4520-52-0x0000026206360000-0x000002620640E000-memory.dmp
          Download

          memory/4520-53-0x0000026206360000-0x000002620640E000-memory.dmp
          Download

          memory/4520-32-0x0000026204300000-0x0000026204305000-memory.dmp
          Download

          memory/4572-549-0x00000000072A0000-0x0000000007343000-memory.dmp
          Download

          memory/4572-540-0x000000006FCF0000-0x000000006FD3C000-memory.dmp
          Download

          memory/4572-523-0x0000000002AC0000-0x0000000002AF6000-memory.dmp
          Download

          memory/4572-524-0x00000000053D0000-0x00000000059F8000-memory.dmp
          Download

          memory/4572-525-0x00000000052E0000-0x0000000005302000-memory.dmp
          Download

          memory/4572-527-0x0000000005A70000-0x0000000005AD6000-memory.dmp
          Download

          memory/4572-526-0x0000000005A00000-0x0000000005A66000-memory.dmp
          Download

          memory/4572-535-0x0000000005AE0000-0x0000000005E34000-memory.dmp
          Download

          memory/4572-536-0x00000000060B0000-0x00000000060CE000-memory.dmp
          Download

          memory/4572-537-0x0000000006140000-0x000000000618C000-memory.dmp
          Download

          memory/4572-539-0x0000000007260000-0x0000000007292000-memory.dmp
          Download

          memory/4572-558-0x0000000007650000-0x0000000007658000-memory.dmp
          Download

          memory/4572-548-0x0000000006680000-0x000000000669E000-memory.dmp
          Download

          memory/4572-557-0x0000000007710000-0x000000000772A000-memory.dmp
          Download

          memory/4572-550-0x0000000007A70000-0x00000000080EA000-memory.dmp
          Download

          memory/4572-551-0x00000000073F0000-0x000000000740A000-memory.dmp
          Download

          memory/4572-552-0x0000000007440000-0x000000000744A000-memory.dmp
          Download

          memory/4572-553-0x0000000007670000-0x0000000007706000-memory.dmp
          Download

          memory/4572-554-0x00000000075D0000-0x00000000075E1000-memory.dmp
          Download

          memory/4572-555-0x0000000007610000-0x000000000761E000-memory.dmp
          Download

          memory/4572-556-0x0000000007620000-0x0000000007634000-memory.dmp
          Download

          memory/4988-65-0x000001B7A0F50000-0x000001B7A0FFE000-memory.dmp
          Download