Overview

overview

9

Static

static

5

2026-08-02...lc.exe

windows10-2004-x64

9

2026-08-02...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 03:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_993a376269fd2ea1e19a14bb66857d20_icedid_stealc.exe
  • Size 117.3MB
  • Sample260803-drfeeabd82
  • SHA256 623853a0ff07529832af9434634d5732171416467d46dc289b8fdceeb5b54101
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 7 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    defense_evasion
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_993a376269fd2ea1e19a14bb66857d20_icedid_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_993a376269fd2ea1e19a14bb66857d20_icedid_stealc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5588
    • C:\Users\Admin\AppData\Local\Temp\a607d0667fb2.exe
      "C:\Users\Admin\AppData\Local\Temp\a607d0667fb2.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:6048
      • C:\Users\Public\u5o33t6v8q\active_desktop_launcher_x64.exe
        "C:\Users\Public\u5o33t6v8q\active_desktop_launcher_x64.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3752
    • C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
      "C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:252
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:3984
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        PID:1676
      • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
        "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2500
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2320
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1124
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=lets.exe
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4472
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=lets.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1896
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO.exe
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2380
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:200
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsPRO
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2052
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2216
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall Delete rule name=LetsVPN
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:948
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe" checkNetFramework
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4128
        • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe" checkNetFramework
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:696
      • C:\Program Files (x86)\letsvpn\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5788
        • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Unexpected DNS network traffic destination
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Modifies system certificate store
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:5712
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C ipconfig /all
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4428
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              6⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:1680
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C route print
            5⤵
            • Executes a command shell one-liner
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2648
            • C:\Windows\SysWOW64\ROUTE.EXE
              route print
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2844
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C arp -a
            5⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3764
            • C:\Windows\SysWOW64\ARP.EXE
              arp -a
              6⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:4976
  • C:\Users\Public\u5o33t6v8q\active_desktop_launcher_x64.exe
    C:\Users\Public\u5o33t6v8q\active_desktop_launcher_x64.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4392
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{be98cf7a-fdae-a548-a215-46fdd82d9286}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000164" "208" "c:\program files (x86)\letsvpn\driver"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:5572
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.inf" "oem1.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000174" "324b"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    PID:2336
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:4160
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4260
    • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
      "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe" /silent
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5216

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          3
          T1059

          PowerShell

          1
          T1059.001

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Netsh Helper DLL

          1
          T1546.007

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Modify Registry

          2
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Network Service Discovery

          1
          T1046

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Remote Services

          1
          T1021

          Remote Desktop Protocol

          1
          T1021.001

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          AddWindowsSecurityExclusion.ps1
          • Path C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
          • Size 318B
          • SHA256 a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          LetsPRO.exe
          • Path C:\Program Files (x86)\letsvpn\LetsPRO.exe
          • Size 243KB
          • SHA256 0e66192b248183324a6f3afc294e25299d096c5fbe9f99dc351613a1cf8d9d84
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CommunityToolkit.Mvvm.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\CommunityToolkit.Mvvm.dll
          • Size 110KB
          • SHA256 11b1add1db058d3760f52512e0ca911af726d7c049f25178446b6bd33d4eecd2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LetsPRO.exe
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
          • Size 1.8MB
          • SHA256 88c4dd1f48b22285b65b1d5114a0a5ec1e636a04a6cf30fc6f489951b1781bd5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LetsPRO.exe.config
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe.config
          • Size 26KB
          • SHA256 bb087f73a88168851eacb2d538163d5253a9879bd1a0568717cb49e0009f5eca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LetsVPNDomainModel.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsVPNDomainModel.dll
          • Size 24KB
          • SHA256 bc8adbe29614f53b2a15b402f9b0f2d21613569cd040ea09f1c3e081806ca86e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Web.WebView2.Core.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Microsoft.Web.WebView2.Core.dll
          • Size 634KB
          • SHA256 fcc07f6b8ddb7c90915dbeaa2d959880bc52266dd49d7fab082f9da698f2bf0c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Newtonsoft.Json.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Newtonsoft.Json.dll
          • Size 695KB
          • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Utils.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Utils.dll
          • Size 135KB
          • SHA256 d144d92dfab0fc0769ca08a605702ba5a2b660f04f6fe30fc719dabf8ba34b9e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log4net.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\log4net.dll
          • Size 264KB
          • SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WebView2Loader.dll
          • Path C:\Program Files (x86)\letsvpn\app-3.20.0\runtimes\win-x86\native\WebView2Loader.dll
          • Size 117KB
          • SHA256 9873644f2668960d66e19d0c62f7812b1b3f35c1f53e8cd61edbb1be311666b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OemVista.inf
          • Path C:\Program Files (x86)\letsvpn\driver\OemVista.inf
          • Size 7KB
          • SHA256 150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tapinstall.exe
          • Path C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          • Size 99KB
          • SHA256 9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          1
          • Path C:\ProgramData\E374A4A30000BA96\1
          • Size 255KB
          • SHA256 5e77836abedd2e236207a18dbcefb42e7002d3ace3c65abd1b316f817d9ca092
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          GROUP
          • Path C:\ProgramData\E374A4A30000BA96\GROUP
          • Size 4B
          • SHA256 b1441fb610c44a4cf71233b0f3f75fb1f47193005b3ea33f6b6259b1448c918b
          • MD5 SHA1 SHA512
          Submit Download

          INSTALL_TIME
          • Path C:\ProgramData\E374A4A30000BA96\INSTALL_TIME
          • Size 38B
          • SHA256 cfa784135cf0dc7abd429016af4ac2e9fdbaeadd4519481c6f4c16f13818460b
          • MD5 SHA1 SHA512
          Submit Download

          index.dat
          • Path C:\ProgramData\E374A4A30000BA96\Modules\x64\index.dat
          • Size 20B
          • SHA256 1eb18da57299a8a5ff0283ae1bfee4a3523a5451f9e3d15d37911f77d620fa0c
          • MD5 SHA1 SHA512
          Submit Download

          index.dat
          • Path C:\ProgramData\E374A4A30000BA96\Modules\x64\index.dat
          • Size 20B
          • SHA256 d815456220056775e7f401c5bb16697b8673146bbde57f3331529cde010c815a
          • MD5 SHA1 SHA512
          Submit Download

          REMARK
          • Path C:\ProgramData\E374A4A30000BA96\REMARK
          • Size 6B
          • SHA256 f3fb9e94f813be2cc4fb1d38777634a8dc079600027b5d19cd373ed21e327347
          • MD5 SHA1 SHA512
          Submit Download

          __PSScriptPolicyTest_yr2tg232.cqd.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yr2tg232.cqd.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          letsvpn-latest.exe
          • Path C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
          • Size 16.7MB
          • SHA256 796640f54bdad0f8a77fdde41ef8d15bde06cc5e1d6920159ebd8ab06a0e4bc9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nst3FA0.tmp\System.dll
          • Size 12KB
          • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          modern-wizard.bmp
          • Path C:\Users\Admin\AppData\Local\Temp\nst3FA0.tmp\modern-wizard.bmp
          • Size 51KB
          • SHA256 076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsDialogs.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nst3FA0.tmp\nsDialogs.dll
          • Size 9KB
          • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsExec.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nst3FA0.tmp\nsExec.dll
          • Size 7KB
          • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          nsProcess.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nst3FA0.tmp\nsProcess.dll
          • Size 4KB
          • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          active_desktop_launcher_x64.exe
          • Path C:\Users\Public\u5o33t6v8q\active_desktop_launcher_x64.exe
          • Size 100KB
          • SHA256 f712c2a8b4abf2e299a2b480020333deb0f43364e9686cda78b1243c62e4830d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          active_desktop_render_x64.dll
          • Path C:\Users\Public\u5o33t6v8q\active_desktop_render_x64.dll
          • Size 107KB
          • SHA256 1e378328734e9af73e1133fd04eaf7f5085132c5bc06a9d166550486ec6d9b66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          utbryiti.ini
          • Path C:\Users\Public\u5o33t6v8q\utbryiti.ini
          • Size 17KB
          • SHA256 e58fdb9b86c0aaf2502068dcc48cca7326476c9cca9c29b537184a21fbdf17ab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          oemvista.inf_amd64_662fd96dfdced4ae.ini
          • Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae.ini
          • Size 418B
          • SHA256 fd6fce0605cdb452b182da073100d61a66b4a89c7c88db2a1ad9d2def26eb244
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tap0901.sys
          • Path \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
          • Size 38KB
          • SHA256 589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tap0901.cat
          • Path \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
          • Size 10KB
          • SHA256 cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/252-524-0x0000000005BB0000-0x00000000061FA000-memory.dmp
          Download

          memory/252-535-0x00000000704C0000-0x000000007050C000-memory.dmp
          Download

          memory/252-538-0x0000000006FA0000-0x0000000006FC0000-memory.dmp
          Download

          memory/252-539-0x0000000007BE0000-0x0000000007C83000-memory.dmp
          Download

          memory/252-540-0x0000000008360000-0x00000000089DC000-memory.dmp
          Download

          memory/252-541-0x0000000007D20000-0x0000000007D3A000-memory.dmp
          Download

          memory/252-542-0x0000000007D90000-0x0000000007D9A000-memory.dmp
          Download

          memory/252-543-0x0000000007F90000-0x0000000008026000-memory.dmp
          Download

          memory/252-534-0x0000000007980000-0x00000000079B6000-memory.dmp
          Download

          memory/252-532-0x0000000006690000-0x00000000066DC000-memory.dmp
          Download

          memory/252-531-0x0000000006640000-0x000000000665E000-memory.dmp
          Download

          memory/252-530-0x0000000006710000-0x0000000006A6B000-memory.dmp
          Download

          memory/252-527-0x00000000064B0000-0x0000000006516000-memory.dmp
          Download

          memory/252-526-0x00000000063D0000-0x0000000006436000-memory.dmp
          Download

          memory/252-525-0x0000000006330000-0x0000000006352000-memory.dmp
          Download

          memory/252-523-0x00000000034C0000-0x00000000034F6000-memory.dmp
          Download

          memory/696-627-0x0000000006350000-0x0000000006402000-memory.dmp
          Download

          memory/696-612-0x0000000005D00000-0x0000000005DA2000-memory.dmp
          Download

          memory/696-596-0x0000000000CA0000-0x0000000000E66000-memory.dmp
          Download

          memory/696-604-0x00000000059A0000-0x00000000059E6000-memory.dmp
          Download

          memory/696-608-0x0000000003410000-0x000000000341A000-memory.dmp
          Download

          memory/696-653-0x0000000007CF0000-0x000000000821C000-memory.dmp
          Download

          memory/696-649-0x0000000006BC0000-0x0000000006BCA000-memory.dmp
          Download

          memory/696-641-0x0000000006B30000-0x0000000006B4A000-memory.dmp
          Download

          memory/696-647-0x0000000006BD0000-0x0000000006BF6000-memory.dmp
          Download

          memory/696-648-0x0000000006BB0000-0x0000000006BB8000-memory.dmp
          Download

          memory/696-646-0x0000000006B90000-0x0000000006B9A000-memory.dmp
          Download

          memory/696-600-0x0000000003220000-0x0000000003246000-memory.dmp
          Download

          memory/696-632-0x0000000006410000-0x000000000676B000-memory.dmp
          Download

          memory/696-642-0x0000000006B50000-0x0000000006B66000-memory.dmp
          Download

          memory/696-640-0x0000000006AF0000-0x0000000006B0E000-memory.dmp
          Download

          memory/3752-47-0x000002E7C0770000-0x000002E7C081E000-memory.dmp
          Download

          memory/3752-45-0x000002E7C0770000-0x000002E7C081E000-memory.dmp
          Download

          memory/3752-51-0x000002E7C0770000-0x000002E7C081E000-memory.dmp
          Download

          memory/3752-52-0x000002E7C0770000-0x000002E7C081E000-memory.dmp
          Download

          memory/3752-66-0x000002E7C0770000-0x000002E7C081E000-memory.dmp
          Download

          memory/3752-69-0x000002E7C0770000-0x000002E7C081E000-memory.dmp
          Download

          memory/3752-32-0x000002E7BE860000-0x000002E7BE865000-memory.dmp
          Download

          memory/3752-31-0x000002E7BE860000-0x000002E7BE865000-memory.dmp
          Download

          memory/4392-64-0x0000027AE4280000-0x0000027AE432E000-memory.dmp
          Download

          memory/5712-689-0x0000000053B00000-0x0000000053B12000-memory.dmp
          Download

          memory/5712-710-0x0000000052A20000-0x0000000052A28000-memory.dmp
          Download

          memory/5712-669-0x0000000028A00000-0x0000000028A0E000-memory.dmp
          Download

          memory/5712-678-0x0000000051FA0000-0x0000000052032000-memory.dmp
          Download

          memory/5712-679-0x0000000006A50000-0x0000000006A58000-memory.dmp
          Download

          memory/5712-680-0x0000000052BD0000-0x0000000052C0E000-memory.dmp
          Download

          memory/5712-681-0x0000000051F90000-0x0000000051F9E000-memory.dmp
          Download

          memory/5712-682-0x00000000538F0000-0x00000000539A0000-memory.dmp
          Download

          memory/5712-683-0x00000000539A0000-0x0000000053A22000-memory.dmp
          Download

          memory/5712-684-0x0000000053A30000-0x0000000053A62000-memory.dmp
          Download

          memory/5712-686-0x0000000053A80000-0x0000000053A96000-memory.dmp
          Download

          memory/5712-687-0x00000000538D0000-0x00000000538DA000-memory.dmp
          Download

          memory/5712-688-0x0000000053AA0000-0x0000000053AAA000-memory.dmp
          Download

          memory/5712-666-0x0000000007980000-0x00000000079A2000-memory.dmp
          Download

          memory/5712-690-0x00000000561A0000-0x00000000561BE000-memory.dmp
          Download

          memory/5712-665-0x0000000006500000-0x000000000685B000-memory.dmp
          Download

          memory/5712-693-0x00000000571C0000-0x000000005777A000-memory.dmp
          Download

          memory/5712-694-0x0000000056590000-0x00000000565DA000-memory.dmp
          Download

          memory/5712-695-0x0000000052250000-0x000000005229C000-memory.dmp
          Download

          memory/5712-698-0x00000000527F0000-0x0000000052893000-memory.dmp
          Download

          memory/5712-705-0x0000000052910000-0x0000000052921000-memory.dmp
          Download

          memory/5712-706-0x000000006D570000-0x000000006E2F6000-memory.dmp
          Download

          memory/5712-707-0x000000006C510000-0x000000006CCD0000-memory.dmp
          Download

          memory/5712-708-0x0000000052910000-0x0000000052920000-memory.dmp
          Download

          memory/5712-709-0x0000000057800000-0x000000005783A000-memory.dmp
          Download

          memory/5712-667-0x0000000007950000-0x000000000795C000-memory.dmp
          Download

          memory/5712-711-0x0000000056A20000-0x0000000056A30000-memory.dmp
          Download

          memory/5712-712-0x0000000056A60000-0x0000000056A7E000-memory.dmp
          Download

          memory/5712-713-0x0000000056A40000-0x0000000056A48000-memory.dmp
          Download

          memory/5712-714-0x000000006D570000-0x000000006E2F6000-memory.dmp
          Download

          memory/5712-715-0x000000006C510000-0x000000006CCD0000-memory.dmp
          Download

          memory/5712-716-0x0000000053510000-0x0000000053522000-memory.dmp
          Download

          memory/5712-718-0x0000000057EC0000-0x0000000057ED6000-memory.dmp
          Download

          memory/5712-717-0x0000000053530000-0x000000005353A000-memory.dmp
          Download

          memory/5712-724-0x000000006D570000-0x000000006E2F6000-memory.dmp
          Download

          memory/5712-725-0x000000006C510000-0x000000006CCD0000-memory.dmp
          Download

          memory/5712-727-0x000000006C510000-0x000000006CCD0000-memory.dmp
          Download

          memory/5712-726-0x000000006D570000-0x000000006E2F6000-memory.dmp
          Download

          memory/5712-729-0x000000006C510000-0x000000006CCD0000-memory.dmp
          Download

          memory/5712-728-0x000000006D570000-0x000000006E2F6000-memory.dmp
          Download

          memory/5712-731-0x000000006C510000-0x000000006CCD0000-memory.dmp
          Download

          memory/5712-730-0x000000006D570000-0x000000006E2F6000-memory.dmp
          Download

          memory/5712-734-0x000000006C510000-0x000000006CCD0000-memory.dmp
          Download

          memory/5712-733-0x000000006D570000-0x000000006E2F6000-memory.dmp
          Download

          memory/5712-736-0x000000006C510000-0x000000006CCD0000-memory.dmp
          Download

          memory/5712-735-0x000000006D570000-0x000000006E2F6000-memory.dmp
          Download

          memory/5712-738-0x000000006C510000-0x000000006CCD0000-memory.dmp
          Download

          memory/5712-737-0x000000006D570000-0x000000006E2F6000-memory.dmp
          Download

          memory/5712-740-0x000000006C510000-0x000000006CCD0000-memory.dmp
          Download

          memory/5712-739-0x000000006D570000-0x000000006E2F6000-memory.dmp
          Download