Overview

overview

8

Static

static

3

2026-07-14...ar.exe

windows10-2004-x64

8

2026-07-14...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 03:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-14_6ff5d2e38fb34869cabe43f8b95d95a4_cloudeye_cobalt-strike_icedid_quasar-rat_satacom_vidar.exe
  • Size 26.1MB
  • Sample260714-eaexzsdw7n
  • SHA256 0dfaa920502f1ee9fdf9c0f393eefd762e7ccc16e66ab89c4c3ce6b95a2da3b6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    defense_evasion
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Network Service Discovery 1 TTPs 2 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 9 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:748
    • C:\Users\Admin\AppData\Local\Temp\2026-07-14_6ff5d2e38fb34869cabe43f8b95d95a4_cloudeye_cobalt-strike_icedid_quasar-rat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-14_6ff5d2e38fb34869cabe43f8b95d95a4_cloudeye_cobalt-strike_icedid_quasar-rat_satacom_vidar.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Users\Admin\AppData\Local\Temp\sfx_0E5954EC\letsvpn-latest.exe
        "C:\Users\Admin\AppData\Local\Temp\sfx_0E5954EC\letsvpn-latest.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5428
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4284
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:5928
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          PID:5664
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:5348
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=lets
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4936
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=lets
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4560
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=lets.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3940
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=lets.exe
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2532
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5004
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsPRO.exe
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2328
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2992
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsPRO
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:6140
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4172
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsVPN
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2752
        • C:\Program Files (x86)\letsvpn\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\LetsPRO.exe" checkNetFramework
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2128
          • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
            "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe" checkNetFramework
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:4960
        • C:\Program Files (x86)\letsvpn\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4056
          • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
            "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Unexpected DNS network traffic destination
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:6048
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C ipconfig /all
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4956
              • C:\Windows\SysWOW64\ipconfig.exe
                ipconfig /all
                6⤵
                • System Location Discovery: System Language Discovery
                • Gathers network information
                PID:2036
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C route print
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3500
              • C:\Windows\SysWOW64\ROUTE.EXE
                route print
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4576
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C arp -a
              5⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3636
              • C:\Windows\SysWOW64\ARP.EXE
                arp -a
                6⤵
                • Network Service Discovery
                • System Location Discovery: System Language Discovery
                PID:5168
      • C:\Users\Admin\AppData\Local\Temp\sfx_0E5954EC\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\sfx_0E5954EC\svchost.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4092
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k FlareHarborGroup -s BlazeGraceSvc
      1⤵
        PID:4728
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{312d86b8-3ae7-1c4c-9aa0-62439fe3023e}\oemvista.inf" "9" "4d14a44ff" "0000000000000138" "WinSta0\Default" "00000000000000EC" "208" "c:\program files (x86)\letsvpn\driver"
        1⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4184
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae\oemvista.inf" "oem1.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "0000000000000138" "f0a5"
        1⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        PID:4972
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
        1⤵
        • Modifies data under HKEY_USERS
        PID:912
      • C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
        "C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe" /silent
        1⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:2452

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            PowerShell

            1
            T1059.001

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Impair Defenses

            1
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Modify Registry

            2
            T1112

            Subvert Trust Controls

            1
            T1553

            Install Root Certificate

            1
            T1553.004

            Credential Access

            Discovery

            Network Service Discovery

            1
            T1046

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            AddWindowsSecurityExclusion.ps1
            • Path C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
            • Size 318B
            • SHA256 a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            LetsPRO.exe
            • Path C:\Program Files (x86)\letsvpn\LetsPRO.exe
            • Size 243KB
            • SHA256 0e66192b248183324a6f3afc294e25299d096c5fbe9f99dc351613a1cf8d9d84
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CommunityToolkit.Mvvm.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\CommunityToolkit.Mvvm.dll
            • Size 110KB
            • SHA256 11b1add1db058d3760f52512e0ca911af726d7c049f25178446b6bd33d4eecd2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LetsPRO.exe
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe
            • Size 1.8MB
            • SHA256 88c4dd1f48b22285b65b1d5114a0a5ec1e636a04a6cf30fc6f489951b1781bd5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LetsPRO.exe.config
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsPRO.exe.config
            • Size 26KB
            • SHA256 bb087f73a88168851eacb2d538163d5253a9879bd1a0568717cb49e0009f5eca
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            LetsVPNDomainModel.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\LetsVPNDomainModel.dll
            • Size 24KB
            • SHA256 bc8adbe29614f53b2a15b402f9b0f2d21613569cd040ea09f1c3e081806ca86e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft.Web.WebView2.Core.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Microsoft.Web.WebView2.Core.dll
            • Size 634KB
            • SHA256 fcc07f6b8ddb7c90915dbeaa2d959880bc52266dd49d7fab082f9da698f2bf0c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Newtonsoft.Json.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Newtonsoft.Json.dll
            • Size 695KB
            • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Memory.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\System.Memory.dll
            • Size 138KB
            • SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.CompilerServices.Unsafe.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\System.Runtime.CompilerServices.Unsafe.dll
            • Size 17KB
            • SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.Runtime.InteropServices.RuntimeInformation.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\System.Runtime.InteropServices.RuntimeInformation.dll
            • Size 27KB
            • SHA256 8bb9d52ba5c67f05c8f632deb1e7e98a909318b10e1388b47e919515fdd42cbf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            System.ValueTuple.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\System.ValueTuple.dll
            • Size 77KB
            • SHA256 e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Utils.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\Utils.dll
            • Size 135KB
            • SHA256 d144d92dfab0fc0769ca08a605702ba5a2b660f04f6fe30fc719dabf8ba34b9e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            log4net.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\log4net.dll
            • Size 264KB
            • SHA256 896ab9cac41e3977792ba2034ea8730610c2779fa51bab6bed426094ea8d3ecd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WebView2Loader.dll
            • Path C:\Program Files (x86)\letsvpn\app-3.20.0\runtimes\win-x86\native\WebView2Loader.dll
            • Size 117KB
            • SHA256 9873644f2668960d66e19d0c62f7812b1b3f35c1f53e8cd61edbb1be311666b0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OemVista.inf
            • Path C:\Program Files (x86)\letsvpn\driver\OemVista.inf
            • Size 7KB
            • SHA256 150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tapinstall.exe
            • Path C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
            • Size 99KB
            • SHA256 9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thorngrace.dat
            • Path C:\ProgramData\Microsoft\Windows\thorngrace.dat
            • Size 924KB
            • SHA256 5547c79ee276d44471fabcbe1703ff83bf6f9fb8375c603793a3c23b0c53ee2e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_bubq2rsv.gp3.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bubq2rsv.gp3.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsd5720.tmp\System.dll
            • Size 12KB
            • SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            modern-wizard.bmp
            • Path C:\Users\Admin\AppData\Local\Temp\nsd5720.tmp\modern-wizard.bmp
            • Size 51KB
            • SHA256 076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsDialogs.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsd5720.tmp\nsDialogs.dll
            • Size 9KB
            • SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsd5720.tmp\nsExec.dll
            • Size 7KB
            • SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsProcess.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nsd5720.tmp\nsProcess.dll
            • Size 4KB
            • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            letsvpn-latest.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sfx_0E5954EC\letsvpn-latest.exe
            • Size 16.7MB
            • SHA256 796640f54bdad0f8a77fdde41ef8d15bde06cc5e1d6920159ebd8ab06a0e4bc9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            svchost.exe
            • Path C:\Users\Admin\AppData\Local\Temp\sfx_0E5954EC\svchost.exe
            • Size 3.5MB
            • SHA256 9d039f4cfced59d2dd6b50cb4cf109f0c8711fc656b73501205c226f651d018a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            oemvista.inf_amd64_662fd96dfdced4ae.ini
            • Path C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_662fd96dfdced4ae.ini
            • Size 418B
            • SHA256 fd6fce0605cdb452b182da073100d61a66b4a89c7c88db2a1ad9d2def26eb244
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tap0901.sys
            • Path \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
            • Size 38KB
            • SHA256 589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tap0901.cat
            • Path \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
            • Size 10KB
            • SHA256 cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/748-15-0x0000011A3D440000-0x0000011A3D51F000-memory.dmp
            Download

            memory/4092-16-0x00007FF70F5E0000-0x00007FF70F844000-memory.dmp
            Download

            memory/4284-487-0x0000000005510000-0x0000000005532000-memory.dmp
            Download

            memory/4284-505-0x00000000078C0000-0x0000000007956000-memory.dmp
            Download

            memory/4284-504-0x00000000076C0000-0x00000000076CA000-memory.dmp
            Download

            memory/4284-503-0x0000000007650000-0x000000000766A000-memory.dmp
            Download

            memory/4284-502-0x0000000007C90000-0x000000000830C000-memory.dmp
            Download

            memory/4284-501-0x0000000007510000-0x00000000075B3000-memory.dmp
            Download

            memory/4284-500-0x00000000068D0000-0x00000000068F0000-memory.dmp
            Download

            memory/4284-497-0x000000006FFE0000-0x000000007002C000-memory.dmp
            Download

            memory/4284-496-0x00000000074A0000-0x00000000074D6000-memory.dmp
            Download

            memory/4284-494-0x0000000006330000-0x000000000637C000-memory.dmp
            Download

            memory/4284-493-0x00000000062E0000-0x00000000062FE000-memory.dmp
            Download

            memory/4284-492-0x0000000005EF0000-0x000000000624B000-memory.dmp
            Download

            memory/4284-489-0x0000000005DA0000-0x0000000005E06000-memory.dmp
            Download

            memory/4284-488-0x0000000005D30000-0x0000000005D96000-memory.dmp
            Download

            memory/4284-486-0x00000000055B0000-0x0000000005BFA000-memory.dmp
            Download

            memory/4284-485-0x0000000002DE0000-0x0000000002E16000-memory.dmp
            Download

            memory/4960-618-0x0000000006050000-0x0000000006058000-memory.dmp
            Download

            memory/4960-558-0x0000000000280000-0x0000000000446000-memory.dmp
            Download

            memory/4960-594-0x0000000005870000-0x0000000005BCB000-memory.dmp
            Download

            memory/4960-603-0x0000000005FD0000-0x0000000005FEA000-memory.dmp
            Download

            memory/4960-611-0x0000000006030000-0x000000000603A000-memory.dmp
            Download

            memory/4960-589-0x00000000057B0000-0x0000000005862000-memory.dmp
            Download

            memory/4960-607-0x0000000005FF0000-0x0000000006006000-memory.dmp
            Download

            memory/4960-619-0x0000000006060000-0x000000000606A000-memory.dmp
            Download

            memory/4960-574-0x00000000052B0000-0x0000000005352000-memory.dmp
            Download

            memory/4960-566-0x00000000051B0000-0x00000000051F6000-memory.dmp
            Download

            memory/4960-615-0x0000000006070000-0x0000000006096000-memory.dmp
            Download

            memory/4960-570-0x0000000004F40000-0x0000000004F4A000-memory.dmp
            Download

            memory/4960-623-0x00000000071A0000-0x00000000076CC000-memory.dmp
            Download

            memory/4960-562-0x0000000002740000-0x0000000002766000-memory.dmp
            Download

            memory/4960-602-0x0000000005F90000-0x0000000005FAE000-memory.dmp
            Download

            memory/6048-665-0x0000000051AC0000-0x0000000051B0C000-memory.dmp
            Download

            memory/6048-682-0x0000000051E90000-0x0000000051E98000-memory.dmp
            Download

            memory/6048-639-0x0000000028330000-0x000000002833E000-memory.dmp
            Download

            memory/6048-648-0x00000000517A0000-0x0000000051832000-memory.dmp
            Download

            memory/6048-649-0x0000000054010000-0x0000000054018000-memory.dmp
            Download

            memory/6048-650-0x0000000053780000-0x00000000537BE000-memory.dmp
            Download

            memory/6048-651-0x0000000053760000-0x000000005376E000-memory.dmp
            Download

            memory/6048-652-0x0000000054CE0000-0x0000000054D90000-memory.dmp
            Download

            memory/6048-653-0x0000000054D90000-0x0000000054E12000-memory.dmp
            Download

            memory/6048-654-0x0000000054C90000-0x0000000054CC2000-memory.dmp
            Download

            memory/6048-656-0x0000000054E30000-0x0000000054E46000-memory.dmp
            Download

            memory/6048-657-0x0000000054C80000-0x0000000054C8A000-memory.dmp
            Download

            memory/6048-658-0x0000000054E50000-0x0000000054E5A000-memory.dmp
            Download

            memory/6048-659-0x0000000054EA0000-0x0000000054EB2000-memory.dmp
            Download

            memory/6048-660-0x0000000055B20000-0x0000000055B3E000-memory.dmp
            Download

            memory/6048-636-0x0000000007150000-0x0000000007172000-memory.dmp
            Download

            memory/6048-663-0x00000000575E0000-0x0000000057B9A000-memory.dmp
            Download

            memory/6048-664-0x0000000055EE0000-0x0000000055F2A000-memory.dmp
            Download

            memory/6048-635-0x0000000005CE0000-0x000000000603B000-memory.dmp
            Download

            memory/6048-668-0x0000000052010000-0x00000000520B3000-memory.dmp
            Download

            memory/6048-677-0x0000000052170000-0x0000000052181000-memory.dmp
            Download

            memory/6048-679-0x000000006C040000-0x000000006C800000-memory.dmp
            Download

            memory/6048-678-0x000000006D0A0000-0x000000006DE26000-memory.dmp
            Download

            memory/6048-680-0x0000000051E60000-0x0000000051E70000-memory.dmp
            Download

            memory/6048-681-0x0000000051F20000-0x0000000051F5A000-memory.dmp
            Download

            memory/6048-637-0x0000000007120000-0x000000000712C000-memory.dmp
            Download

            memory/6048-683-0x0000000051EA0000-0x0000000051EB0000-memory.dmp
            Download

            memory/6048-684-0x0000000051ED0000-0x0000000051EEE000-memory.dmp
            Download

            memory/6048-685-0x0000000006520000-0x0000000006528000-memory.dmp
            Download

            memory/6048-686-0x000000006D0A0000-0x000000006DE26000-memory.dmp
            Download

            memory/6048-687-0x000000006C040000-0x000000006C800000-memory.dmp
            Download

            memory/6048-689-0x0000000006260000-0x0000000006272000-memory.dmp
            Download

            memory/6048-690-0x0000000006250000-0x000000000625A000-memory.dmp
            Download

            memory/6048-691-0x0000000006620000-0x0000000006636000-memory.dmp
            Download

            memory/6048-697-0x000000006C040000-0x000000006C800000-memory.dmp
            Download

            memory/6048-696-0x000000006D0A0000-0x000000006DE26000-memory.dmp
            Download

            memory/6048-699-0x000000006C040000-0x000000006C800000-memory.dmp
            Download

            memory/6048-698-0x000000006D0A0000-0x000000006DE26000-memory.dmp
            Download

            memory/6048-701-0x000000006C040000-0x000000006C800000-memory.dmp
            Download

            memory/6048-700-0x000000006D0A0000-0x000000006DE26000-memory.dmp
            Download

            memory/6048-703-0x000000006C040000-0x000000006C800000-memory.dmp
            Download

            memory/6048-702-0x000000006D0A0000-0x000000006DE26000-memory.dmp
            Download

            memory/6048-705-0x000000006C040000-0x000000006C800000-memory.dmp
            Download

            memory/6048-704-0x000000006D0A0000-0x000000006DE26000-memory.dmp
            Download

            memory/6048-707-0x000000006C040000-0x000000006C800000-memory.dmp
            Download

            memory/6048-706-0x000000006D0A0000-0x000000006DE26000-memory.dmp
            Download

            memory/6048-709-0x000000006C040000-0x000000006C800000-memory.dmp
            Download

            memory/6048-708-0x000000006D0A0000-0x000000006DE26000-memory.dmp
            Download

            memory/6048-711-0x000000006C040000-0x000000006C800000-memory.dmp
            Download

            memory/6048-710-0x000000006D0A0000-0x000000006DE26000-memory.dmp
            Download